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Preface 



As explained in the Foreword, the Advisory Commit- 
tee on Major Hazards was set up by the Health and 
Safety Commission towards the end of 1974 to con- 
sider the safety problems associated with large-scale 
industrial premises conducting potentially hazardous 
operations. 

In their first report, published by the Commission in 
September 1976, the committee recommended that 
regulations should be introduced requiring persons 
having control of certain types of installations to send 
details of their activities to the Health and Safety Ex- 
ecutive. Public response to this concept of a notifica- 
tion scheme was generally favourable and in June 
1978 a Consultative Document on Hazardous Instal- 
lations (Notification and Survey) Regulations was 
issued by the Commission. The replies to this docu- 
ment are being considered by the Health and Safety 
Executive. The publication of this second report is in- 
tended to maintain public discussion of the 
philosophy behind the committee's thinking as well as 
their specific recommendations. 

The Commission welcomes the report as making a 
further important contribution to current thinking 
about the safety of hazardous industrial operations in 
this country. 

The report is very much in the nature of a discussion 
document and as the Commission is anxious to con- 
tinue the general informed debate on major hazard 
problems, the views of bodies and individuals primari- 
ly concerned will be welcome. 

Any comments should be sent in writing to Mr H E 
Lewis, Health and Safety Executive, 25 Chapel Street, 
London, NW1 5DT, to reach him not later than the 
end of February 1980. 

W SIMPSON 

Chairman, Health and Safety Commission 
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Foreword 



The committee was appointed by the Health and 
Safety Commission at the end of 1974 "To identify 
types of installations (excluding nuclear installations) 
which have the potential to present major hazards to 
employees or to the public or the environment and to 
advise on measures of control, appropriate to the 
nature and degree of hazard, over the establishment, 
siting, layout, design, operation, maintenance and 
development of such installations as well as over all 
development, both industrial and non-industrial, in 
the vicinity of such installations. " 



In our first report, published in September 1976' , the 
Chairman of the Commission invited interested bodies 
and individuals to send in their comments so that 
these could be fed back into discussions at the for- 
mative stage. We thank all those who did respond. 
The comments received, including those from CBI and 
TUC, have helped clarify our thinking, particularly in 
the preparation of this second report. 

Meetings were arranged between the committee and 
some of the bodies with a particular interest in major 
hazards to discuss comments. These included the 
British Chemical Engineering Contractors Association; 
the Chemical Industries Association; the Council of 
Engineering Institutions; the Royal Town Planning In- 
stitute; the British Insurance Association; the Institute 
of Petroleum and the Institution of Gas Engineers. 

Our first report stressed the importance of research 
into the problems presented by major hazards and, in 
view of the need to keep abreast of worldwide devel- 
opments in this area, we decided in October 1977 to 
set up a fifth working group specially for this pur- 
pose. 

The work of the five groups forms the basis of this 
second report which deals with historical information 
on major hazards, including explosion hazards; siting 
and structure of control buildings and protection of 
workpeople; planning; legal controls and a possible 
licensing scheme; research and future work. The re- 
port also outlines the thinking behind the notification 
scheme currently the subject of the consultative docu- 
ment on Hazardous Installations (Notification and 
Survey) Regulations 1978 issued by the Commission 2 . 
This detailed account of our work will, we hope, act 
as a catalyst in encouraging a general informed debate 
on major hazard problems. 



Throughout our deliberations we have been conscious 
of the recommendations of the Court of Inquiry into 
the Flixborough disaster and have taken account of 
them in this report; consequently, we have not set 
aside a particular chapter for specific comment. 

Type of major hazards 

The committee has examined historical evidence to 
assess the frequency, causes and consequences of 
major incidents in the UK and overseas. Those 
resulting in deaths involving toxic gases, extremely 
toxic materials, flammable liquids and gases, and 
unstable and highly reactive materials are listed in 
table form, along with such details as: source of 
leakage; nature of incidents; materials involved; quan- 
tity of material and numbers of deaths. This evidence, 
the committee concludes, shows no more than that 
tonne-for-tonne conventional explosives, ammonium 
nitrate, flammable gases, chlorine, and possibly 
phosgene, seem about equally hazardous, with am- 
monia appearing to be less dangerous. 

However, the mortality indices calculated from this 
evidence should be used as no more than a framework 
of reference and the relative levels for notification 
must remain a judgement that is reasonable and 
generally acceptable. 

Consideration of the behaviour of large clouds of 
flammable vapours mixed with air shows that such 
mixtures can give rise to effects which at a distance 
are difficult to distinguish from the detonation of 
high explosives. Despite the efforts devoted to study- 
ing such clouds, the information available is far from 
complete or conclusive and will remain so for many 
years. 

The factors which determine the size of a vapour 
cloud explosion and its destructive effect at any given 
location are examined. These include: quantity of 
material and TNT equivalent; fraction likely to flash 
off to form a cloud; composition of cloud; extent of 
drift; pressure and duration of blast. Guidance is 
given on the likely strengths, duration and range of 
blasts which will be useful in the consideration of the 
design of buildings on major hazard sites. Values have 
been calculated for these parameters using knowledge 
of the behaviour of structures subjected to known 
degrees of blast from high explosives, notably TNT. 

Protection of people and control buildings 

The elements of managerial control and categories of 



1 Experience of major accidents 
and problems in evaluation of major 
hazards 



The criteria for the assessment of major 
hazards is discussed by firstly examining 
historical experience and then by considering 
the techniques of theoretical prediction. The 
consequences and frequency of world-wide 
incidents involving toxic gases and 
substances, vapour cloud explosions and 
fires, and highly reactive and unstable 
substances are examined. Although the quan- 
titative information derived from those oc- 
currences provides no more than a 
framework of reference, the historical data 
in general supports the levels at which inven- 
tories should become notifiable. The com- 
plementary role of the techniques of 
theoretical prediction is emphasized. 



1 In our first report, at para 48, we set out an in- 
terim list of substances and processes which we 
thought should be made notifiable. Much of this 
Chapter is concerned with a review of that list, and 
Chapter 2 then describes the action taken by the 
Health and Safety Commission in arranging for draft 
regulations to be prepared on the basis of the list. We 
have first studied the historical evidence of certain 
major incidents in order to ascertain the number of 
casualties in relation to the quantities of hazardous 
substances involved, to see if there is any common 
ground for the various catergories of hazard and to 
what extent this could assist us in assessing whether 
the inventories proposed for notification purposes were 
of the right order because the list, although based 
upon considerable experience drawn both from the 
Health and Safety Executive and ourselves, was 
prepared pragmatically. We describe the results of this 
review in paras 3-21 below. It would have been 
perhaps too much to expect that our analysis of 
historical data would have precisely matched the levels 
which we proposed for notification in our first report. 
However, we believe that the historical data in general 
support the levels set out for notification. 

2 This review has borne out the statement made in 
our first report that the ultimate potential of an inci- 
dent is seldom realised, and that the number of 
casualties and extent of damage depend on the in- 
teraction of a whole range of factors. Hence a study 
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of past events cannot be relied upon on its own, as a 
means of predicting what will happen in certain cir- 
cumstances and we therefore go on in paras 22-26 to 
outline some of the problems involved in evaluating 
hazards. We have not dealt extensively in this report 
with predictive techniques but we are aware that this 
important and developing subject is being studied by 
experts in this field and we believe it is worthy of 
deeper consideration. 

3 In order to assess the frequency, causes and conse- 
quences of major incidents, we have studied sum- 
maries and reports of recorded events that have occur- 
red in the UK and overseas, in particular those which 
involved: 

(i) Toxic gases which, following release in tonnage 
quantities, were lethal or harmful for considerable 
distances from the point of release. 

(ii) Extremely toxic material which, following release 
and dispersion in kilogramme quantities, was lethal or 
harmful for considerable distances from the point of 
release. 

(iii) Flammable liquids or gases which, following 
release in tonnage quantities, formed a large flam- 
mable cloud, which in turn burnt or exploded. 

(iv) Unstable or highly reactive materials which have 
exploded. 

We have restricted ourselves to studying the number 
of fatalities, because injuries are less easily quantified. 

4 In our analysis we needed, however, to be cautious 
because we found that available information on major 
incidents was frequently unreliable. It has to be 
remembered that such information is often based on 
reports from people who could well have been in con- 
siderable danger, who may have been subject to shock 
and who did not fully understand the technical im- 
plications of what they were witnessing; all factors 
which are likely to add to the well-known fallibility of 
eye-witness accounts. Also we have noted that the 
data quoted in the original reporting by the news 
media have a great persistence and can override more 
authoritative data arrived at later by official inquiries 
or by technically competent investigators. We, in this 
report, quote what we think is the most reliable inform- 
ation available, and in our tables of selected incidents 
we give the quantities and number of fatalities only 
when we consider these are known with a reasonable 
degree of certainty. 

5 In considering the historical evidence we have 



Table A Releases of chlorine 










Location 


Date 


Area/site 


Source of leakage 


Quantity released 
(tonnes) 


Number of 
fatalities 


1 Baton Rouge 
Louisiana 


10 12 76 


Factory 


Storage tank 


90 





2 Rauma 
Finland 


5 11 47 


Factory 


Storage tank 


30 


19 


3 Cornwall 
Ontario 


30 12 62 


Urban/Rural 


Rail tanker 


28 





4 Griffith 
Indiana 


13 3 35 


— 


Rail tanker 


27 





5 La Barre 
Louisiana 


31 161 


— 


Rail tanker 


27 


1 



6 St Auban 
France 


13 12 26 


Factory 


Storage tank 


24 


19 


7 Syracuse 


10 5 29 


Factory 


Storage tank 


24 


1 



New York 



8 Zarnesti 
Rumania 


24 12 39 


Factory 


Storage tank 


24 


60 


9 Wyandotte 
Michigan 


1917 


Urban 


Storage tank 


17 


1 


10 Chicago 
Illinois 


4 2 47 


Urban 


Rail tanker 


16 





1 1 Niagara Falls 
New York 


8 2 34 


Factory 


Rail tanker 


15 


1 


12 Walsum 

West Germany 


4 4 52 


Factory 


Storage tank 


15 


7 


13 Brandts ville 
Pennsylvania 


28 4 63 


Rural 


Rail tanker 


8 





14 Mjodolen 
Norway 


26 1 40 


Factory 


Rail tanker 


7 


3 


15 Freeport 

Texas 


1949 


Factory 


Pipeline 


4 





16 Lake Charles 
Louisiana 


10 3 56 


Factory 


Connecting pipework 


3 





17 Johnsonburg 
Pennsylvania 


12 11 36 


Factory 


Rail tanker 


2 





18 Mobile 
Alabama 


12 7 64 


Factory 


Pipeline 


Unknown 


1 



Mean mortality index = 



Total number fatalities 



based on incident 
Nos 1-17 in Table 



Total amount lost 
_ 112 
361 
= 0.3 



made use of the study carried out by one of our 
members Mr V C Marshall 3 . The tables and mortality 
indices published in that reference have been subjected 
to intense critical scrutiny and revision by ourselves 
and our Secretariat before arriving at the figures 
quoted in the report. In the course of studying these 
tables and other incidents we also have calculated 
'mortality indices' i.e. the number of fatalities per 
tonne of material released, because we see this as a 
possible way of comparing various categories of 
hazard. The information we can draw on is limited 
and applies only to those materials produced in the 
largest tonnage quantities. There is insufficient 
historical experience for many of the substances 
named on our list. 



6 The major proportion of tonnage toxic releases 
recorded refer to chlorine. There are a number of 
reasons for this, not least the fact that chlorine has 
been produced and used on a significant scale since 
the beginning of the century. + Table A lists 

f The highest death toll from chlorine in recorded history appears 
to be that which arose not from its use in an industrial context 
but from the use of the gas as a weapon of war against un- 
protected troops at Ypres in April 1915. Some 168 tonnes of 
chlorine were released over a period of about 5 minutes along a 7 
kilometre front in circumstances deliberately chosen to maximise 
the toll of human life. If the most extreme estimate of 5000 
fatalities is to be believed, and there is reason to think that it may 
be an over-estimate, the mortality index did not exceed 30 
fatalities per tonne. The fatalities represented some 20% of the 
allied troops in the battle zone at the time. 
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Table B Releases of ammonia 



Location 



Date 



Area/site 



Source of leakage 



Quantity released Number of 
(tonnes) fatalities 



Floral 
Arkansas 


5671 


Rural 


Pipeline 


600 





Enid 
Oklahoma 


7 5 76 


Urban 


Pipeline 


500 





Conway 

Kansas 


6 12 73 


Rural 


Pipeline 


277 






Landskrona 
Sweden 



16 176 



Port 



Ship-storage connection 



180 



Blair 
Nebraska 



16 1 1 70 



Rural 



Storage tank 



160 



Crete 
Nebraska 



18 2 69 



Urban 



Rail tanker 



90 



Belle 

West Virginia 

Texas City 
Texas 



21 170 

3 9 75 



Urban 



Urban 



Rail tanker 


75 





Pipeline 


50 





Storage tank 


38 


18 + 


Road tanker 


19 


6 



Potchefstroom 
S Africa 



Houston 

Texas 



13 7 73 
11 576 



Urban 



Urban 



Lievin 
France 



21 8 68 



Urban 



Road tanker 



19 



Mean mortality index 



Total number fatalities 
Total amount lost 

41 



2008 
= 0.02 

1" Without this incident the mean mortality index = 0.01 

significant accidental releases of chlorine. Some of 
these releases resulted from hydrogen, generated by 
the same electrolytic process that produced the 
chlorine, finding its way into the chlorine storage 
where it reacted explosively. 

7 It seems likely, that in recent years operational 
practices to say nothing of engineering techniques and 
even mitigatory measures intended to reduce fatalities 
in the event of a major release to atmosphere have 
considerably improved. The table shows that in the 
case of storage tanks the worst incidents occurred 
thirty or more years ago and this in spite of the great 
increase in the scale of production of chlorine since 
the end of the Second World War. Further inform- 
ation on chlorine incidents provided by the Chlorine 
Product Group 4 of the Chemical Industries Associa- 
tion, and shown in Fig 1 bears this out. 

8 Most of the other recorded toxic releases of 
significance relate to ammonia, a gas which has also 
been produced and used in large quantities for over 
half a century. Major rapid releases are listed in Table 
B which shows a lower mean mortality index for am- 
monia than for chlorine which in our view is to be ex- 
pected and is consistent with its lower toxicity. 
However, information on the behaviour of ammonia 
released from both refrigerated and pressurised 
systems is needed, and we are glad to record that fur- 
ther research is being undertaken. 



Fatalities 
per decade 



60 



40 



■20 



Fatalities 



Millions of tonne 
production / 

per 
decade 




1900 


1910 


1920 


1930 


1940 


1950 


1960 


1970 


1909 


1919 


1929 


1939 


1949 


1959 


1969 


1977 



Decades 
Fig 1 World production and known fatalities from incidents 
involving liquid chlorine. Source: Chemical Industries Association, 
Chlorine Product Group. 
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9 We have found only one industrially recorded in- 
cident involving phosgene and it occurred in Ham- 
burg in May 1928, when 10 tonnes were released 
from a store and ten people were killed. 

10 There are substances which are more toxic than 
those mentioned above, and a small number can be 
lethal to man even in microgramme doses. A most 
serious incident of this nature was the accidental 
release of tcdd (2,3.7,8 — tetrachloro-dibenzo-p- 
dioxin) at Seveso in Italy in 1976. Here, this highly 
toxic substance was not part of the normal chemical 
process but was produced as an accidental by-product 
in an uncontrolled exothermic reaction. Reports have 
indicated that kilogramme quantities were released 
and the nature of the incident led to dispersal of the 
substance over a large area. No immediate fatalities 
were reported. This incident however underlines the 
difficulties associated with setting criteria for the 
limits above which substances should require special 
notification and control. While TCDD is no longer 
produced in the UK under normal operating condi- 
tions, nor, we understand, is it likely to be produced 
in any significant quantity under abnormal conditions, 
we regard as essential the inclusion of a further 
category in the proposed regulations for notification 
and hazard surveys (see Chapter 2) to include sub- 
stances which might be described as violently toxic. 

1 1 Vapour cloud explosions and fires are always 
spectacular. We would like to believe that as a conse- 
quence, most of the incidents which have occurred in 
other countries have been recorded, but unfortunately 
we cannot be certain that this is so. In 1972 Strehlow 5 
collated and analysed incidents known to him and 
drew attention to the increasing danger from the 
deflagration* of unconfined vapour clouds. Surveying 
the events of the previous 42 years, he listed no fewer 
than 108 incidents which had occurred, mainly in the 
USA but also in Germany and Holland and which had, 
in total, cost 386 lives and 173 million dollars. His 
data appear to show that the frequency of incidents 
was increasing at a significant rate; from about four 
in one decade to a rate of over 60 per decade as can 
be seen from Fig 2. At that time no such major 

* See Glossary 

Table C Sudden releases of flammable gases or vapour 



1501 



100- 




1 65 incidents 



1930 



1940 



1950 



1960 



1970 



Fig 2 Data from Strehlow 



catastrophes had occurred in the UK. In March 1977 
J A Davenport presented an updated resume of vapour 
clouds to the American Institute of Chemical 
Engineers 6 where he listed 22 incidents occurring in 
the five years from 1972 to 1976. 

12 Our investigations have shown that there has 
been a greater number of releases of flammable than 
of toxic materials. The consequences range from 
harmless dispersion to fire or explosion which in some 
cases has been of considerable magnitude. The events 
that follow a release are governed by many factors 
and, while those which determine whether an explo- 
sion will occur are at present not well defined, it ap- 
pears that, in broad terms, and perhaps not surpris- 
ingly, the smaller the quantity of flammable vapour 
and the less it is confined, the lower the likelihood of 
an explosion. 

13 The character and effects of vapour cloud explo- 
sions are discussed in detail in Chapter 5. For the mo- 
ment, it is sufficient to note the data in Table C, 
which gives examples of incidents that have occurred 
with flammable materials, to provide an indication of 
what can happen, However, in drawing any conclusion 
from the list, it should be borne in mind that it is 
selective. The table includes some relatively well 
known incidents which have significance for some 
particular reason - usually because of the number of 
fatalities, the quantity of material released or the ex- 
plosive effect. We have excluded incidents where ig- 
nigtion did not occur. 



Quantity of material 
lost (Tonnes) 



Location 



Date 



Source of Nature of Material 
Area/site leakage incident involved Total 



Time to 

ignition Number of 



Before 

ignition (minutes) fatalities 



1 


Austin 
Texas 


22 2 73 


rural 


pipeline 


fire 


NGL 


530 


80- 


100 


10- 12 


6 


2 


Climax 
Texas 


29 6 74 


rural 


rail tanker 


explosion 


vinyl 
chloride 


more than 
100 


100 




short 





3 


Decatur 
Illinois 


19 7 74 


urban 


rail tanker 


explosion 
and fires 


isobutane 


not known 


69 




10 


7 


4 


Port Hudson 
Missouri 


9 12 70 


rural 


pipeline 


explosion 


propane 


360 


60 




24 





5 


East St Louis 
Illinois 


22 1 72 


urban 


rail tanker 


explosion 


propylene/ 

propane 


more than 
56 


56 max 


1 
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Table C (continued) 



Location 



23 Petal City 
Mississippi 



Quantity of material 
lost (Tonnes) 
Source of Nature of Material Before 

Date Area/site leakage incident involved Total ignition 



Time to 

ignition Number cf 

(minutes) fatalities 



6 Pernis 

Holland 


20 1 68 


factory 


storage tanl 


. explosion 


mixed 
hydroca- 
rbons 


more than 
50 


more than 
50 


8 


2 


7 Flixborough 
UK 


16 74 


factory 


chemical 
reactor 


explosion 


cyclohexane more than 
40 


40 


less than 1 


28 


8 Ludwigshafen 
Germany 


28 7 48 


factory 


rail tanker 


explosion 


demethyl 
ether 


30 


30 


not known 


207 


9 Meldrim 

Georgia 


28 6 59 


rural 


rail tanker 


fire 


LPG 


36 


18 


short 


23 


10 New Berlin 
New York 


25 7 62 


urban 


road tanker 


fire 


LPG 


13 


13 


not known 


10 


1 1 Los Angeles 
California 


18 1 43 


rural 


road tanker 


fire 


butane 


8 


8 


not known 


5 


12 Beek 
Holland 


7 1175 


refinery 


reactor 


explosion 


propylene 
fraction 


5.5 


5.5 


2 


14 


13 Longview 

Texas 


25 2 71 


factory 


¥' diameter 
pipeline 


explosion 


ethylene 


'tonnes' 


0.5 


not known 


4 


14 Cleveland 
Ohio + 


20 10 44 


urban 


bulk storage 


: fires and 
explosions 


LNG 


more than 
2000 


not known 


short 


128-136 


15 Hearne 

Texas 


14 5 72 


rural 


pipeline 


explosion 
and fire 


crude oil 


1000 


not known 


270 


1 


16 Devers 
Texas 


12 5 75 


rural 


pipeline 


explosion 


NGL 


800 


not known 


7 


4 


17 Lake Charles 
Louisiana 


8 8 67 


refinery 


storage 
sphere 
connection 


explosion 


isobutane 


40 


not known 


not known 


7 


18 San Carlos 
Spain* 


11 7 78 


holiday 
camp 


road tanker 


fire 


propylene 


22? 


not known 


short 


more than 
150 


19 Natchitoches 
Louisiana 


4365 


urban 


pipeline 


explosion 


natural gas 
(methane) 


not known 


not known 


17 


21 


20 Amsterdam 
Holland 


10 8 71 


factory 


— 


explosion 


butadiene 


not known 


not known 


more than 
45 


8 


21 Antwerp 

Belgium 


10 2 75 


factory 


compressor 
pipe 


explosion 


ethylene 


not known 


not known 


4 


6 


22 Umm Said 
Qatar 


3 177 


refinery 


storage tank 


: explosion 
and fires 


NGL 


not known 


not known 


not known 


6 



25 8 74 



storage- 


under- 


explosions 


butane 


several 


not 


plant 


ground 
storage 
cavern 




(LPG) 


thousands 





known not known 



24 Plaquemine 
Louisiana 



3 5 63 



factory reactor 



explosion ethar.e- 
ethylene 
mixture 



not known not known 0.5 



Mean mortality index 
(based on incidents when the amount 
released before ignition can be 
estimated ie Nos 1-13 in table) 



total number of fatalities Mean mortality index 

total amount lost before ignition (based on incidents when the 

306 total amount released can be 

530 estimated, ie Nos 1-12 & 14-18) 



total no of fatalities 
total amount released 

599 
5090 



0.6 



- 0.1 



Confined and unconfined explosions have not been differentiated here because we had insufficient information to do so. 

This table is in two parts; items 1-13 are listed in order of magnitude of the quantity of material lost before ignition. This information is 
not given for items 14-24 which are therefore listed in order of magnitude of the total quantity of material lost. 

^Because of conflicting official reports the exact number of fatalities is uncertain; we have identified their probable range. 

*Based on unofficial press reports 

The table has a preponderance of incidents which involved road or rail tankers. This may reflect the fact that such incidents are probably 
subject to more rigorous and accurate reporting, particularly in the usa by the National Transportation Safety Board. They have been 
included to indicate the possible effects of the release of flammable materials although the circumstances of release are not of direct 
relevance to the work of this committee. 
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14 Incidents where large flammable clouds did not 
explode but instead burned with great intensity have 
been described by Marshall 7 . Such clouds may start to 
burn around their envelopes and 'lift off to form 
fireballs*, which are dangerous in the extreme. When 
formed of hydrocarbons, they are luminous and 
radiate sufficient heat to cause fatal burns to by- 
standers, and to ignite wood and paper; for example, 
they have been known to set fire to the interior of of- 
fice blocks. As fireballs rise they produce mushroom 
clouds, in the stalks of which are formed violent up- 
ward convection currents which suck up and ignite 
debris, and scatter burning brands over a wide area. 
Such an occurrence can clearly cause damage far 
beyond the normal safety distance of what are termed 
conventional fires. This hazard has not been ade- 
quately investigated. We recommend that there be fur- 
ther examination of such occurrences. 

15 Table C also shows that cross-country pipelines 
carrying gas or liquefied gases at high pressures con- 
tain enough material to produce a significant vapour 
cloud in the case of fracture. A very extensive net- 
work of pipelines has been in operation in the USA for 
several decades and major releases have occurred. One 
of the most notable examples was in 1970, in 
Missouri, near Port Hudson, when a pipeline built in 
1931 split open for approximately 2 metres along a 
welded joint; a considerable quantity (some 60 tonnes) 
of propane was released into open country and event- 
ually ignited to give one of the largest known vapour 
cloud explosions; however no-one was killed. The 
total length of pipelines in use in the UK is con- 
siderably less than in the USA and is primarily for 
natural gas transmission and distribution. Most of the 
pipelines have been installed during the last fifteen 
years, although some of the petrol and oil lines were 
installed before or during the Second World War. 
While there have been failures on UK pipelines 
systems, none has led to a serious incident. One of 
our working groups currently engaged in investigating 
pipeline hazards has concluded that certain pipelines 
can pose a potential threat to people and property in 

See Glossary 

Table D Serious incidents involving reactive substance 



the vicinity, and discussion on the specific require- 
ments for the inclusion of pipelines in the proposed 
notification scheme is well advanced. 

16 Another potential source of an explosive release 
of energy is a range of substances which are highly 
reactive or unstable when subjected to pressure, 
temperature, mechanical force or when mixed with 
other reactive material. Such substances include 
acetylene, ammonium nitrate, sodium chlorate, nitro- 
cellulose compounds, peroxides, both organic and in- 
organic, and certain organic oxides such as ethylene 
oxide. Some of these have been produced industrially 
on a significant scale since the beginning of the cen- 
tury and continue to be necessary for many manufac- 
turing processes, in some cases specifically on account 
of their highly reactive properties. Of these substances 
ammonium nitrate has been the cause of some 
disastrous explosions, although in more recent times 
such events have become a rare occurrence, due, we 
believe, to the introduction of stricter controls and the 
use of carefully considered methods of manufacture 
and storage. This continuing improvement in safety is 
characteristic of the matters we have considered and 
we refer to it later in this chapter in connection with 
the need for predictive techniques. An indication of 
the catastrophic result of the realisation of the poten- 
tial hazard from such a material is demonstrated by 
three serious incidents which occurred with am- 
monium nitrate in the first half of this century and by 
two more recent incidents with ethylene oxide, as 
shown in Table D. 

17 It may not be justifiable directly to compare the 
reactive substances mentioned above with conven- 
tional explosive as the former may be used in situ- 
ations where they are rendered less reactive by e.g. 
dilution or the addition of an inhibitor. However it 
is our view that such a comparison is worthwhile and 
accordingly we have examined the analysis of 162 
accidental explosions given in Reference 3 which was 
based upon References 8 and ' . This information has 
been summarised here in Table E and plotted in a 
convenient form in Fig 3 to give an indication of the 
variation of the effects with increasing size of incident. 



Location 


Date 


Area /site 


Circumstances 


Material 
involved 


Tonnes 


Number of 
fatalities 


Oppau 

Germany 


21 9 21 




Store exploded 


Ammonium 
Nitrate 


4000 


561 


Texas City 
Texas 


16/18 4 47 


Docks 


Two ships blew up 


Ammonium 
Nitrate 


About 4000 


550 


Brest 

France 


28 4 47 


Docks 


Ship blew up 


Ammonium 
Nitrate 


2500 


21 


Doe Run 
New York 


17 5 62 


Factory 


Storage tank blew up, 
aerial explosions followed 


Ethylene Oxide 


35 


1 


Antwerp 

Belgium 


4 6 64 


Factory 


Reflux vessel blew up, 
aerial explosion followed 


Ethylene Oxide 


1 


4 



1132 



Mean mortality index Ammonium Nitrate = 10 E 0n 



= 0.1 
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18 In Chapter 2 we discuss the notifiable level for 
materials being held under pressure in situations in 
which there is considerable potential for destruction. 
We have not been able to adduce any historical 
evidence for this particular threat, but it is our view 
that where there is a level of potential energy in such 
systems, which if released could cause widespread 
damage, a major hazard exists. Thus, as there is 
always the possibility, however remote, that the 
pressure vessel or associated plant could burst, it is 
necessary that these installations are not excluded 

Table E Mortality indices for different classes of incident 



from the scheme for notification and hazard survey. 

1 9 We cannot leave this subject without some men- 
tion of the hazard of dust explosions although we 
have not as yet studied the problem in depth. Even 
when the experience in mines has been excluded dust 
explosions, infrequent though they may be in this 
country, have resulted in a number of fatalities. For 
example, in 1911 there were two incidents in which 
there were a total of forty five fatalities and in 1 930 
one incident in which eleven people were killed. Since 



Class range of class 
(lb) 



2 Total quantity 
exploded in class 
(tonnes) 



3 Total number of 
incidents in class 



5 Mean quantity of 
4 Total deaths in explosive per incident 6 Mortality index 

class in class (tonnes) (fatalities per tonne) 



10 

31.6 

100 

316 

1,000 

3,160 

10,000 

31,600 

100,000 

316,000 

1,000,000 

3,160,000 

10,000,000 




0.437 



5.76 
26.86 
90.29 



5t 

17 
28 
33 
29 
23 
10 
11 



117% 



17 

41 

140 
119 

504 

694 

82 

970 

3242 



0.086 



38.90 



0.338 


7.12 


0.95 


5.21 


2.73 


1.31 


9.68 


1.79 


23.77 


1.27 


82.1 


0.10 


47 


0.36 



1966 



0.275 



Mean quantities of explosive per incident (column 5) are obtained by dividing the figure in column 2 by the figure in column 3, and 
mortality indices (column 6) are obtained by dividing the figure in column 4 by the figure in column 2. In Fig. 3 the figures in columns 5 
and 6 are plotted against each other. 

+The paucity of data in the lower range is, in our view, due to a considerable under-reporting of such incidents, and since the incidents 
causing fatalities are more likely to be reported, the mortality index in this range is most likely to be an over-estimate. 



10 I 



> 1 J 



0.1 




© 



Theoretical line with mortality 
index cc (quantity)' 3 



2 3 4 5 6 78 



3 3 4 5 6 7 s 9 



10- 



io- 1 



1 



2 3 4 5 6 7 a 9 1 2 3 4567891 

10 100 



3 4 5 6 7 8 9 1 2 3 456789 

1000 10 000 



Mean quantity of explosive - tonnes 
Fig 3 Variation of mortality index with size of incident for explosives (from table E) 
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1941 there have been a number of explosions in this 
country four of which resulted in a total of eighteen 
fatalities. Similar explosions have occurred overseas. 
For example, in 1919 at a starch/corn plant at Cedar 
Rapids, USA, forty three persons were killed, and in 
1942, at a similar plant in Peking, Illinios, USA, forty 
two persons were killed. More recently in December 
1977, thirty five people died in an explosion in West 
Wego and another seventeen died in an explosion in 
New Orleans. 

Such dust explosions have usually, but not exclusively, 
taken place in premises processing grain into animal 
or human foodstuffs. The fatalities are usually the 
result of the collapse of buildings or structures, and to 
this extent the effects are localised. Materials which 
present a risk of a dust explosion are, however, to be 
found in a wide range of industries. It is generally 
considered that the potential hazard exists in the cir- 
cumstances of the production of sugar, starch and 
flour where large quantities of flammable dusts are 
processed in tall or multi-storied structures of heavy 
construction. 

Premises in which large quantities of aluminium or 
magnesium powder are processed are a matter of par- 
ticular concern, as these materials have in the past 
produced explosions of exceptional severity. For ex- 
ample, two incidents in the USA, one in 1917, and the 
other in 1929, each resulted in eight fatalities. Thus, 
while the incidents involving dusts or powders usually 
have effects which could be termed local, and are 
therefore excluded from the notification scheme in the 
proposed regulations for the present, we propose to 
look at this topic more closely in the future. 1 " 

20 In paragraph 5 attention was drawn to the poss- 
ible use of the mean mortality index of various 
substances as a measure of their degree of hazard. 
Because the data are limited and their deviation is 
wide, considerable caution must be exercised; the 
figures must be regarded as very approximate and 
should not be taken out of context. Variations in the 
circumstances of release give rise to a widely differing 
number of fatalities. For instance, in the case of 
chlorine, Table A shows that the highest value arose 
from the Zarnesti incident, where 60 people were kill- 
ed by the release of 24 tonnes in a factory, while at 
Baton Rogue there were no fatalities from a 90-tonne 
release which by chance was carried by wind across 
the wide Mississippi 10 . Similarly, in the case of flam- 
mables, Table C shows that about 22 tonnes of pro- 
pylene released by mischance near a holiday camp at 
San Carlos caused the death of over 150 persons by 
fire, whereas although 70 tonnes of propane released 
at Port Hudson caused an explosion, no-one was kill- 
ed. Thus the mortality index from individual incidents 
in themselves varies too much to be very helpful, and 
even the mean from all the available reliable inform- 
ation is too dependent on individual incidents to be 
regarded as accurate. From the tables it can be seen 
+ See Chapter 9 



that, tonne for tonne and at the levels of inventory* 
of interest to us and bearing in mind the accuracy of 
the data, conventional explosives, ammonium nitrate, 
flammable gases, chlorine (and if we can take note of 
the one recorded incident, phosgene) seem about 
equally hazardous, and ammonia appears to be much 
less dangerous. This seems about as far as the analysis 
should take us. The mortality indices should be used 
as no more than a framework of reference, and the 
relative levels for notification must remain a judge- 
ment that is reasonable and generally acceptable, 
based upon consideration of the properties, effects, 
use of and experience with the various materials. On 
this basis we accordingly see no reason to change the 
previously recommended levels particularly bearing in 
mind that these are intended to serve as a means for 
bringing the proposed notification controls into play. 

21 In considering historical experience such as that 
outlined in the preceding paragraphs, one must take 
many other factors into account. We have already 
called attention to some of these in para 4. In ad- 
dition, for example, there is no doubt that there is a 
bias which arises from failure to record publicly small 
incidents, especially where fatalities have not occur- 
red. This is evidenced in Table E where there is a 
paucity of data for small explosions. From the point 
of view of the study of major hazards, which is con- 
cerned with large releases, this difficulty may not be 
very serious. There are serious problems also in draw- 
ing conclusions from history in times of rapid change. 
Mankind normally learns from disasters and this 
learning process makes it less likely that any given 
combination of disastrous circumstances will be 
repeated. The operation of this factor tends to make 
the lessons of history too pessimistic; mitigatory 
measures taken as a result of the study of experience, 
such as the provision of personal protection, more ef- 
fective evacuation of the population at risk, better 
emergency services and general advances in medicine 
which reduce the risk of death from injury will all 
tend to reduce the number of fatalities. On the other 
hand the introduction of novel processes and the 
growth of scale of existing processes create new 
problems for which historical analysis may have few 
or inadequate answers. 

22 As anticipated in para 2, having arrived at a list 
of notifiable activities we now consider some of the 
problems involved in evaluation of hazards at sites 
where these activities are being carried on. We 
recognised that realisation of the hazard depends on 
many considerations. Assessing the potential hazard in 
any specific situation requires the application of 
historical experience, suitably adjusted to take account 
of all relevant factors and circumstances for the site in 
question. It is sometimes possible to make direct use 
of information relating to a previous accident in 
assessing the possible consequences of a postulated 
release of energy or toxic or flammable material, but 
it is often necessary to consider different cir- 

See Glossary 
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cumstances of wind, weather, population distribution, 
and so on. Theoretical approaches designed to in- 
dicate the possible consequences of various types of 
accidents must take account of such factors as the 
properties of the material, the design and construction 
of the system, the nature of the process, the local 
population density, relevant climatic data and 
topography, and at the same time pay due regard to 
assumptions that are reasonable and are founded on 
reliable and realistic data. The fact that the potential 
of a particular hazard has not been realised may be 
significant but it does not mean that such an event 
could not or will not happen. 

23 These problems require a theoretical approach 
which embodies imagination of high quality to foresee 
situations that are without direct historical precedent 
but are, nevertheless, not beyond the bounds of 
credibility. The models used to evaluate hazards are 
generally consistent with historical experience when 
applied to events which involve the energy within a 
high-pressure system, conventional explosives, heat 
radiation from catastrophic fires, or the formation of 
a toxic or flammable cloud of the same density as air. 
Difficulties arise when any vapours released are ap- 
preciably lighter or heavier than air because assump- 
tions have to be made in the absence of reliable data 
and proven theories of cloud behaviour. 

24 The spectrum of possible assumptions in hazard 
evaluation can lead to a range of predicted casualties 
often varying by orders of magnitude. A combination 
of assumptions such as the release of a large quantity 
of a hazardous substance in weather conditions which 
will allow it to affect a very densely populated area 
with no scope for escape from the hazard produces 
predictions of very large numbers of casualties. A 
combination of all the worst possible circumstances 
would however be very rare, and thus the possibility 
of a large-scale disaster is very remote. This is at least 
consistent with the limited historical experience. In 
contrast one can also use a combination of assump- 
tions which have a combined probability which broad- 
ly accords with current expectations based on 
historical experience. 

25 Additional factors may affect greatly the number 
of casualties. These could include on-site emergency 
action by the plant operators to protect themselves 
from the effects of the release, as well as arrange- 
ments to limit the inventory lost, and to alert other 
people at risk. A slow rate of release and certain 
wind and weather conditions coupled with a low 
population density downwind of the point of release 
particularly within the first kilometre or so could all 
reduce the number of casualties. Moreover if people 
in the path of the cloud become aware of it by sight 
or smell and if the concentration is not too high, they 
might be able to move away from the cloud or to pro- 
tect themselves before they are overcome. As we discuss 
below, there is some evidence to support the form- 
ulation of a scaling law (i.e. a law which relates an- 



ticipated fatalities to the quantity of agent involved) 
for explosives, and it may be that with sufficient data 
such a law could be deduced for toxic releases. This is 
a field for further theoretical and experimental work. 

26 In the case of vapour cloud or other explosions 
the lethal blast wave travels outwards at high speed, 
and people caught in its path have no time to protect 
themselves from any physical damage that may occur. 
Explosion waves attenuate fairly rapidly, and their 
decay can be estimated with some accuracy. Provided 
the size and nature of the explosion can be predicted 
then reference to historical data will allow explosives 
experts to make predictions of the type and scale of 
damage which will result. The rapidity with which ex- 
plosions occur simplifies the problem of theoretical 
prediction by virtually eliminating the evacuation fac- 
tor which plays a major role in the study of toxic 
releases. If it be assumed that the probability of fatal 
injury in an explosion is a function of the level of 
overpressure*, Hopkinson's Scaling Law would lead 
to the conclusion that number of fatalities (F) would 
for a given situation be a function of (M ' 3 ) 2 ; ie M ' 3 
where M is the mass of the explosive. If then, the 
mortality index Im is defined as Pj, it would be ex- 
pected that Im would be a function of M J . 

The above relationships are derived from the assump- 
tion that the distance at which a given effect is pro- 
duced varies as the cube root of mass M, and the 
number of persons involved varies as the square of 
that distance. From the analysis of the effects of 162 
accidental explosions mentioned previously, and plot- 
ted on Fig 3, it appears that the exponent from the 
best fit line is close to the theoretical value of " . 
Prediction of the size of a vapour cloud explosion is 
difficult, but given that one can assume the rate of 
release of flammable vapour and the conditions of 
formation of the vapour cloud, then estimates of the 
type and scale of the consequences can again be 
made. In general terms, and put to practical use as we 
have attempted to do in Chapters 5 and 6, we believe 
we have found that such predictive calculations of 
damage and casualties can agree reasonably well with 
the pattern obtained from actual incidents. 

27 We may perhaps summarise our conclusions from 
this Chapter by saying that we believe that there is 
considerable value in the historical approach in that it 
provides quantitative information on actual oc- 
currences and that the figures so derived, in spite of 
their many shortcomings, provide at least some bases 
for estimating the levels at which inventories should 
become notifiable. We believe also that techniques of 
prediction have an indispensable role to play both in 
allowing us to reach a greater understanding of the 
historical record and in enabling us to foresee situ- 
ations for which historical evidence is lacking or insuf- 
ficient. Such techniques, to be valid, however, 

must always lead to results in specific cases which 
accord with the generality of historical experience of 
major incidents. 
* See Glossary 
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2 Notifiable inventories and 
proposed regulations 



This chapter seeks to justify the level of in- 
ventory of the specific substances contained 
in Schedule 1 of the proposed regulations 
and of situations in which there is the 
possibility of considerable potential for 
destruction due to materials being held under 
pressure. It explains how the committee has 
refined and developed its earlier thoughts in 
the context of the survey, assessment, and 
appraisal of various categories of installa- 
tion. 



28 In August 1977, the Health and Safety Commis- 
sion announced the preparation of regulations which 
would require the notification, hazard survey and, in 
some cases, detailed assessment of existing and pro- 
posed premises and installations having, or likely to 
have prescribed quantities of hazardous substances or 
prescribed processes. The regulations would be made 
and enforced by the use of powers contained in the 
Health and Safety at Work etc Act 1974 - a matter 
which we return to in Chapter 3. The prescribed 
quantities for notification purposes would be based on 
the criteria set out in our first report at para 48. In 
June 1978 the Commission published a consultative 
document containing the proposed regulations and 
guidance notes on hazard surveys and we await with 
interest the comments from those consulted. In this 
chapter we seek to explain how the preliminary 
thoughts in our first report were refined and developed 
into recommendations to the Commission. 

29 We had been criticised in comments on our first 
report for taking a pragmatic approach to the pro- 
blem of deciding the level of inventory which would 
constitute a 'notifiable level'. Pragmatism means to us 
'treating the facts of history in their connection with 
each other as cause and effect and with reference to 
their practical lessons'. There may have been altern- 
atives to the pragmatic approach but we believe that 
they were unlikely to ease the problems of identifying 
potential major hazards. 

30 The proposal which was subjected to the most 
severe criticism was the concept of 'chlorine 
equivalent'. Ironically, such criticism, in effect, sup- 
ported the argument for the pragmatic approach and 
in consequence, we translated the basic criteria into a 



list of the more important substances and processes 
(see para 35). In doing so, we modified certain 
notifiable quantities but did not attempt precise mat- 
ching because of known approximations indicated in 
the previous chapter. Indeed, 15 tonnes of flammable 
vapour is not directly equivalent to 5 tonnes of ex- 
plosives. The former could produce a 'soft' explosion 
whereas the latter will produce a 'hard' explosion but 
in reality their potential to do harm is of a similar 
order of magnitude. 

31 We took account of the numerous comments and 
representations made as a result of the publication of 
our first report. We were pleased to find that much 
common ground existed both outside and within 
government circles as to what should be notifiable and 
as to what the notifiable level should be. Indeed there 
was a remarkable measure of agreement between our 
new list and the list used by HSE and local planning 
authorities for the existing consultation arrangements 
decribed in Chapter 5 of our first report. The latter 
list was based on the experience and intuition of HM 
Factory Inspectorate and was first brought into use in 
1972. 

32 Our new list is not exhaustive: for example, there 
are numerous substances which are more toxic than 
chlorine but most of them are not kept, as far as we 
know, in sufficient quantities to justify our listing 
them. In deciding the notifiable levels for various tox- 
ic substances, we had to consider, for each substance, 
its general toxicity, its physical properties, and its 
vapour pressure, and to agree a quantity which in our 
judgement and in the experience of the Health and 
Safety Executive, is equivalent in its effect to 10 ton- 
nes of chlorine. An entirely different class of toxic 
substances demanded attention, particularly after the 
escape of TCDD from Seveso in 1976 which is describ- 
ed in Chapter 1 . In the case of flammable materials, 
we set different notifiable levels for gases. The dif- 
ferent quantities arise from variations in behaviour on 
release. In the case of gases the full inventory could 
be immediately available for cloud formation whereas 
in the case of liquids, despite the 'champagne effect' 
which occurs on release of pressure, it is unlikely that 
all the inventory would be immediately available for 
cloud formation. 

33 Where any substance is kept under pressure, there 
is always the possibility however remote, that the 
pressure vessel or systems will burst and scatter itself 
and its contents. In the case of a catastrophic failure 
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of a vessel under high presssure the energy is divided 
mainly between the kinetic energy of the fragments 
and the energy of the shock wave. The damage caused 
by the shock wave from a rupturing vessel can be esti- 
mated approximately by assuming that it is the same 
as that caused by detonation of such amount of TNT 
as will release the same energy. The procedure is prac- 
ticable in view of the extensive literature of the effect 
of explosives on structures. Assuming that the con- 
tained substances are inert, the actual range of the 
effects of a catastrophic failure depends primarily on 
the size of the vessel and the pressure at the time of 
the failure. The factor suggested by the High Pressure 
Technology Association in their High Pressure Safety 
Code is 1 kg TNT = 4.5 x 10 6 J which is in pressure 
volume terms, approximately equivalent to 45 m 3 
bars. Consequently it is possible to select with suf- 
ficient accuracy for our purposes, the vessel size and 
pressure levels which in their own right may be poten- 
tially very hazardous. 

34 We well appreciate that theoretically even 1 tonne 
of any of the listed substances, if released in confined 
and crowded circumstances , could lead to a substan- 
tial number of fatalities, but suggest that such pos- 
sibilities are best dealt with in accordance with current 
practice and by enforcement of current safety 
legislation. We would not want to see valuable and 
limited resources diverted from the examination and 
control of hazards which inherently pose an even 
higher level of threat to safety. We concluded that the 
scale of the quantities in our list is of the right order 
and that any future changes in the list would be by 
the way of refinement. Indeed, we believe the net to 
be fine enough to catch all major hazard installations. 

35 At the request of HSC we modified the proposals 
in our first report and the revised list we subsequently 
presented is as follows: 



INVENTORIES REQUIRING NOTIFICATION 




Group 1 Toxic substances 




phosgene 


2 tonnes 


Chlorine 


10 tonnes 


Acrylonitrile 


20 tonnes 


Hydrogen cyanide 


20 tonnes 


Carbon disulphide 


20 tonnes 


Sulphur dioxide 


20 tonnes 


Bromine 


40 tonnes 


Ammonia 


100 tonnes 


Group 2 Substances of extreme toxicity 




Toxic liquids or gases likely to be lethal 




to man in quantities of less than one 




milligramme 


100 grammes 


Toxic solids likely to be lethal to man in 




quantities of less than one milligramme 




other than those which are and which will 




be maintained at ambient temperature and 




atmospheric pressure. 


100 grammes 


Group 3 Highly reactive substances 




Hydrogen 


2 tonnes 


Ethylene oxide 


5 tonnes 


Propylene oxide 


5 tonnes 


Organic peroxides 


5 tonnes 



Nitrocellulose compounds 
Ammonium nitrate 
Sodium chlorate 
Liquid oxygen 

Group 4 Other substances and processes 

Flammable gases not specified in any other 

group. 

Flammable liquids above their boiling point 

(at 1 bar pressure) and under pressure greater 

than 1.34 bar including flammable gases 

dissolved under pressure but not mentioned 

in any other cateogory. 

Liquefied petroleum gases such as commercial 
propane and commercial butane and any mixture 
thereof. 

Liquefied flammable gases under refrigeration 
which have a boiling point below 0°C at 1 bar 
pressure and are not included in Groups 1-3. 

Flammable liquids of flash point less than 
21 °C not included in Groups 1-3. 

Compound fertilisers 
Plastic foam 



50 tonnes 

500 tonnes 

500 tonnes 

1000 tonnes 



15 tonnes 



20 tonnes 



30 tonnes 



50 tonnes 



10000 tonnes 

500 tonnes 
500 tonnes 



36 We also recommended in our first report that 
notification should be required for installations with a 
large inventory of stored pressure energy, typically 
process operations at 100 bars or above using gas 
phase reaction. On reflection we considered that a 
pressure of 100 bars above atmospheric was too high 
and we subsequently suggested that notification 
should be required for any process using plant at a 
pressure greater than 50 bars when the product of the 
volume of the pressure system in cubic metres and the 
pressure in bars exceeds 10 000. 

37 After further deliberations in the committee we 
recommend consistent with the arguments of para 33 
above, that the proposed regulations should cover all 
pressure systems having a gas or vapour phase except 
for steam boilers for which we consider adequate con- 
trols already exist. When calculating the pressure 
energy for notification etc., the volume occupied by 
any liquid should be ignored. 

38 We did not overlook the fact that the use of a list 
of this nature can give rise to some anomalies. In our 
suggested scheme we recommended that the quantity 
of a substance for which notification is required 
should be the total amount of materials that is stored 
and/or is in process within the boundaries of an in- 
stallation. Thus, adjoining installations in separate 
ownership each having, say 9 tonnes of chlorine 
would not be notifiable. This omission was inten- 
tional: in our view there is not a strong case for the 
aggregation of hazardous substances if completely 
separate control is involved. Historical experience in- 
dicates that events leading to the simultaneous release 
of separate inventories are remote. This may not be so 
for connected vessels, but we believe that cases where 
there is connection between stored inventories under 
separate ownership/control will be rare. 

39 Similar considerations apply to undetakings 
which have, under one control, a number of hazard- 
ous substances all in quantities below the notifiable 
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level. Again the likelihood of an event which would 
lead to a simultaneous release of several toxic and/or 
flammable categories from separate vessels appears to 
be remote because of the separation distances normal- 
ly adopted and the absence of direct pipe connections 
between the vessels. Although a combination of 
hazardous categories might be brought together in a 
process vessel, the total must be a fraction of that in 
store. 



Notification regulations 

40 We recommended that the proposed regulations 
should require a person, who at any one time keeps, 
manufactures, processes or uses a notifiable quantity 
of hazardous substance in any place, to supply infor- 
mation about the undertaking. 

We suggested: 

(1) name and address of person making the 
notification; 

(2) address and postal code of the place to be 
notified, or ordnance survey grid reference; 

(3) approximate area of the installation or place 
covered by the notification; 

(4) a general description of the activities carried on 
e.g. oil refinery, water treatment works, fertiliser 
store, research station; 

(5) for the notifiable substances or processes — a list 
of those which are kept or are expected to be kept 
in excess of the notifiable levels, and the estimated 
maximum quantities for each or generated by or 
contained in each such process. 

41 The above information was, for the sake of 
simplicity, intentionally limited but it would be 
sufficient to enable a crude appreciation of the hazard 
potential to be made. The Health and Safety Execu- 
tive will want to examine and analyse the information, 
and their analysis will give us a better indication of 
the range and scale of hazards which we have to 
consider. 

42 We understand that the adoption of this 
notification scheme could lead to several thousand 
notifications, perhaps as many as five thousand. The 
majority of these will not require any special surveil- 
lance, and HSE examination of the notification will 
identify those which will continue to receive normal 
surveillance by virtue of the enforcement of the 
Health and Safety at Work etc Act 1974. 

Hazard surveys 

43 In our first report we recommended that 
following notification the operating organisation 
should carry out in selected cases a hazard survey. 
The objectives of this survey are: 

(1) To provide information and data on the nature 
and scale of the hazards involved. 

(2) To identify the more critical features of the 



hazardous undertaking and of the systems used to 
control the hazards. 

(3) To cause the operating organisation to review the 
events which could lead to loss of containment of 
the most hazardous inventories and the 
consequences of such loss. 

44 We envisage that the key information and 
conclusions will be distilled by the operating 
organisation and that the resulting report will be 
submitted to HSE. This will enable HSE to allocate its 
resources for surveillance more effectively. It will also 
give the Executive a better understanding of the 
undertaking and of its possible threat to public safety 
for purposes of advising local planning authorities 
about developments involving, affecting or affected 
by the undertaking. Furthermore, both the Executive 
and this committee would acquire a better appre- 
ciation of the type and number of installations which 
may require detailed assessment. 

45 We originally envisaged that all notifiable 
installations, whether existing or proposed, would be 
the subject of a hazard survey. Because there are only 
a limited number of trained people available, in 
industry to carry out surveys and in HSE to appraise 
them, the Commission advised us that the proposed 
notification regulations should contain criteria which 
would identify 'priority sites' which would then be 
statutorily required to produce a hazard survey. The 
Commission invited us to consider how these criteria 
should be arrived at and we discussed various altern- 
ative methods. We understand that multiplication by 
a factor of 10 of the quantities now set out in our list 
(see para 35) appears likely to produce a not unman- 
ageable number of sites in the first instance. We 
therefore suggested the use of this factor but stressed 
that we believe it should serve as no more than an 
interim first step based on practical considerations 
and should in no way represent a refined technique 
for selecting sites with the greatest hazard. The 
unsatisfactory feature of a factor of this scale is that 
it gives undue and spurious weight to inventory at the 
expense of other factors such as the nature of the 
threat that such inventories pose and the population 
at risk. We therefore urged the Commission that the 
regulations should be prepared in a form which would 
facilitate amendment of the criteria at appropriate 
intervals. 

46 Although this limitation on hazard surveys 
originally arose from the scarcity of resources we see 
some advantage in working down from what are 
obviously the largest installations. We envisage that in 
due course it will be found appropriate to require 
hazard surveys for notifiable installations other than 
those which exceed the notification inventories by a 
factor of 10, but not necessarily for all notifiable 
installations. 

47 The hazard survey should be carried out, bearing 
in mind the objectives listed in para 43. In the field of 
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major hazards it is necessary to consider in particular 
relatively rare but potentially catastrophic events. The 
hazard survey should deal, therefore, with these 
hazards as well as with those which are considered 
more likely. In this context large inventories of 
hazardous material are particularly important. 

48 The hazard survey should state the ways in 
which, under fault conditions, the hazardous material 
might escape from containment, the quantity and rate 
of release of the material, the effects which the escape 
might have, the probability of its occurring and the 
precautions taken to prevent it. Thus, for example the 
possibility of the loss of the total inventory from a 
vessel must be considered, but, depending on the cir- 
cumstances, it may be acceptable to state reasons why 
a large release may be disregarded. Such reasons might 
be factors relating to physical possibility such as lack 
of energy for dispersion of the material, or to measures 
such as bunding or to factors relating to probability 
of the release such as pressure vessel integrity. 

49 The hazard survey should not be a once for all 
exercise and further surveys should be required. We 
have recommended that a further survey be carried 
out when the basis of the last survey is likely to 
become invalid because of changes in the substances 
or processes or inventories, the additional survey 
being completed before the changes are made; also in 
every case at an appropriate fixed interval. The draft 
regulations in the consultative document reflect these 
recommendations. The document also contains draft 
guidance on the preparation of hazard surveys. 

Detailed assessment 

50 We said in our first report (para 31) that in some 
cases the company's hazard survey might have to be 
followed by a more detailed assessment if HSE called 



for it, particularly at those installations appearing to 
present the highest risk or involving novel or rapidly 
changing technologies. The hazard survey should help 
to pinpoint these, as well as those features which are 
or will be most critical. 

51 Our proposals for detailed assessment which have 
been incorporated into the consultative document, 
include amongst other features: 

(1) Management systems and staffing arrangements 
by which any hazard is controlled. 

(2) Safety systems and procedures for the control of 
any hazard. 

(3) Qualifications, experience and training of staff 
concerned. 

(4) Design and operating documentation. 

(5) Design and operation of containment and pressure 
systems. 

(6) Protection of personnel from the effects of loss of 
containment. 

(7) Emergency plans. 

(8) Reporting of and learning from incidents. 

52 Detailed assessments are likely to be very costly 
both in terms of the expert resources that they require 
and the time that they take. It is not our wish, nor do 
we expect, that such assessments will be required 
indiscriminately or in large numbers. Although it is 
too early to be sure, we suspect that where a detailed 
assessment is required this will often be for just one 
or two aspects of the undertaking or of the particular 
installation. More might be required if it were decided 
that the premises should be controlled by inductive 
regulations or licensing, but we discuss that prospect 
in the next chapter. 
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3 Legal controls 



Those installations which pose the greatest 
threat to safety have been identified, and 
consideration has been given to what add- 
itional controls may be required to evoke 
from those who operate such installations, 
their evidence that the process does not 
present an unacceptably high level of risk. 
The committee considers the possibility of 
further controls by regulation or 'licensing' 
and, at Appendix 1 sets out in detail an overt 
form of an outline scheme for 'licensing'. 
The committee proposes, however, to keep 
an open mind and to hold further discussions 
when the initial response to the proposed 
notification regulations has been evaluated. 

53 In our first report, we mentioned various forms 
of additional legislative control which might be 
applied to a limited number of installations. Our 
overall concern is to ensure that whatever further 
legislative procedures are considered, they should be 
aimed at ensuring that the decision making processes, 
whether initially at the design stage, or during the 
course of production, or — in extreme cases — in the 
face of imminent disaster, are primarily influenced by 
considerations of safety. Whenever management or 
workers are presented with choices where a funda- 
mental element in making a decision may be a safety 
consideration, it is our aim to ensure that they favour 
caution. To say this is not to overlook the excellent 
safety record of much of modern industry using new 
and often complex processes which is due to the fact 
that decisions are made with proper regard to safety. 
Nevertheless management and workers are obviously 
concerned with maintaining production, and may 
sometimes feel tempted under pressure to take a 
chance rather than to play it safe. 

54 It would perhaps be foolish, however, to assume 
that all the things that go wrong are due to someone 
taking a chance in favour of production rather than 
of safety. Far more serious may be the wrong 
decisions which are made in ignorance. Proper 
decision making requires adequate competence to 
understand the implications of the various choices 
which lie open. In some cases, ignorance may be very 
subtle. A designer may, for instance, need to know 



what level of uncertainty is acceptable in going from a 
pilot stage to full-scale production. The manager of a 
plant faced with a reaction that is behaving in an 
unusual manner may well be in a situation that is 
entirely novel for him. He may be ignorant of the 
significance of the changes which are taking place. 

55 It can be seen that any proposals for intervention 
which will infuence decision making in these circum- 
stances, and which go beyond the general duties 
already laid upon management by the Health and 
Safety at Work etc Act 1974, are not easily envisaged, 
since they must take account not only of unwise de- 
cisions, but perhaps more often of decisions based on 
ignorance or incompetence. Ideally, then, any new 
regulations should provide a mechanism to ensure that 
the unwise think again, that the ignorant seek 
knowledge, and that the incompetent are never in 
control. But how can this be achieved? The answer to 
that question is and has been fundamental to all our 
deliberations. 

56 Perhaps we should report here that in response to 
our first report, where we clearly envisaged that some 
form of further legal intervention additional to the 
HSW Act would emerge, it has been strongly put to 
us that no such further action is needed. The 
argument, so it seems, is that the best run companies 
have fine safety records and that this comes about by 
the ordinary commercial pressures on competent man- 
agement. It is concluded that no company will 
willingly lay waste to its own assets, and that the 
financial penalties of destroying its plant* together 
with the actions for damages which would probably 
follow, are a greater deterrent to mismanagement than 
any legal intervention could be. 

57 We would not contest that the best run 
companies achieve high standards of safety, but we 
believe this is because they have to a great degree 
systematised the procedures necessary to keep their 
plants both safe and productive. We believe that they 
have set themselves high standards of competence for 
their key staff, and at the same time they have 
instituted procedures which will make manifest to 
themselves that all is going well. They have learned 
that tests and checks which in 99 cases out of 100 
prove to be unnecessary, will only be continued if the 
production system is such as to ensure that they must 
continue to be made. Above all, they have achieved 

* See Glossary 
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what is perhaps best described as technical discipline 
in all that they do. 

58 We believe that the best practices must be 
followed by all companies and that we have reached a 
state of technological development where it is not suf- 
ficient in areas of high risk for employers merely to 
demonstrate to themselves that all is well. They 
should now be required to demonstrate to the 
community as a whole that their plants are properly 
designed, well constructed and safely operated. 
Another argument put to us for taking no further 
action is that any attempt to intervene in the affairs 
of these hazardous plants will inevitably lead to a 
growth of a 'vast army' of civil servants to operate 
the scheme. We are only too conscious that such a 
development would be undesirable, but, as we said in 
our first report, it would also be impossible because 
of the comparative scarcity of manpower of the right 
skills. Indeed, this comparative shortage of skills is 
one of the factors which we have had to consider in 
framing our proposals. 

59 Our first report has also evoked the suggestion 
that further legislative intervention in this field would 
result in levels of risk being imposed on workers and 
the public to which they had not agreed, and they 
would have had no say in determining how safe a 
particular plant, in which they work, or which is 
situated near to their homes, is to be made. We do 
not believe that any proposals for further intervention 
would in any way touch on the question of what level 
of risk is acceptable. We made it clear in our first 
report that this was an area where public debate was 
desirable, and we suggested that there might well be 
circumstances in which the level of risk judged to be 
acceptable was a political decision. 

60 We do not think that improved safety in relation 
to the plants and processes with which we have been 
asked to deal, will emerge automatically from public 
debate, and a statutory framework for further inter- 
vention may be needed. But it should be clear from 
our first report that we consider that any further 
statutory provisions should be cast in the mould of 
the Robens proposals by evoking from those who 
operate hazardous plants further evidence that the 
process is safely controlled. 

Control by regulations 

61 There are two main avenues by which this objec- 
tive may be achieved. We note that the Health and 
Safety at Work Act empowers the Secretary of State 
for Employment to make regulations (at the request 
of or in consultation with the Health and Safety Com- 
mission) on some thirty different subjects which are 
set out in Schedule 3 of the 1974 Act. The range of 
subjects is without doubt sufficient to provide for 
more specific legal control of all aspects of hazards. 
Such regulations would, it is to be expected, be sup- 
plemented by codes of practice approved by the 
Health and Safety Commission, and by notes of 



guidance prepared by the Health and Safety Executive. 
It should therefore be technically possible to produce 
regulations which would demand certain procedures 
to be undertaken by all plant operators. Not to comply 
with these requirements would naturally involve the 
enforcement procedures of the Health and Safety at 
Work etc Act 1974. 

62 There are however certain drawbacks to the intro- 
duction of specific controls on these lines. The need 
to escape from a system of detailed rules enforced by 
an ever increasing army of government inspectors il- 
luminates much of the Robens Report. The key to 
what the Robens Committee thought was needed is to 
be found at paragraph 28 of their report when they 
declared 'the primary responsibility for doing some- 
thing about the present levels of occupational ac- 
cidents and disease lies with those who create the risks 
and those who work with them.' The Health and Safe- 
ty at Work Act 1974 has given clear legislative form 
to this concept in the early sections of the Act which 
impose general duties on employers and has extended 
it, as Robens intended, to embrace the safety of the 
public as well — a matter of vital concern to us. The 
proposed notification and hazard survey regulations 
follow this concept. 

63 We think that the overall intention of any such 
regulations should be to require a company to identify 
the problems of its own situation, to decide the stan- 
dards, systems and priorities which should apply, and, 
when required, to show the HSE the conclusions it has 
come to and the solutions to the problems which it 
proposes. Inductive regulations of this kind would 
have many attractions. In particular there is no need 
to limit in advance the range of installations to which 
they might be applied. The existing enforcement pro- 
cedures by improvement and prohibition notices 
would automatically apply and they could be made to 
affect existing installations without difficulty. It might 
be possible for such regulations to require the 
operating organisation to show for example, that for 
each prescribed stage of the process, it had taken such 
steps as were necessary to ensure the safety of the 
process, and that procedures which were essential to 
safe operation were under control of personnel whose 
competence in terms of relevant experience and 
qualifications had been formally assessed. Regulations 
would have to follow (even if simplified) a recognised 
pattern and would not in themselves provide for in- 
dividual variations to suit special circumstances. There 
could be a degree of flexibility where such regulations 
followed the pattern, for instance of boiler legislation 
and required a competent person to report on certain 
aspects of the plant, but it would not be possible to 
escape from the overall framework which 
characterises regulations of this type. 

64 To sum up legislation in this field could be con- 
ceived in terms of the general duties imposed by the 
HSW Act, supplemented by regulations made under 
the Act to a pattern which is already familiar in rela- 
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tion to the risks in other areas of occupational health 
and safety, but we do have reservations as to its effec- 
tiveness with regard to potentially high hazard plants. 

Control by licensing 

65 The alternative is to proceed to a form of control 
which can be broadly described as licensing. We think 
that the issue of licences appears to engender a degree 
of public confidence in the control of hazards, 
because of the assumption that the installation will be 
thoroughly checked before the official body is 
prepared to issue a licence. Moreover, compliance is 
not assumed until the licence is issued, whereas in the 
case of regulations compliance is assumed until the 
contrary is established. Given the allocation of the 
same enforcement resources, at some stage it is 
necessary to consider which particular form of legal 
control is likely to be most effective. 

66 Contemplation of a licensing scheme cannot take 
place in isolation and we have been conscious of the 
various problems which present themselves when the 
subject of further intervention is investigated. Indeed, 
we have been forced to ask ourselves some fundamen- 
tal questions as to the purpose and effectiveness of 
legal constraints on technological developments and 
the success or otherwise which can be expected to at- 
tend the adoption of any further form of control. In 
our first report we expressed the view that this 
mechanism might well have to be evoked in the case 
of a small number of plants which presented the 
highest level of risk. Licensing, we pointed out, has 
been in a great variety of applications such as ex- 
plosives, nuclear energy, petroleum spirit storage and 
manufacture of drugs. We also said that a licensing 
scheme might license plants or it might license the 
people in control of plants, or even a combination of 
both. Our main concern in the consideration of licens- 
ing schemes is that we should not weaken the respon- 
sibility of the employer for safety, since in the long 
run there can be no substitute for the employer's 
awareness of his own responsibilities, and we believe 
that proposals for further legislative intervention 
should enhance rather than detract from those respon- 
sibilities. 

67 The many licensing schemes which we have ex- 
amined differ from one another in the degree of inter- 
vention which they allow the enforcement authority to 
exercise. Where the risk is minimal or where a licence 
is no more than a revenue raising exercise there may 
be virtually no intervention at all. At the other end of 
the scale a licence can become the framework for con- 
trolling all operations connected with the activity in 
question. In the latter case the concept emerges that 
all activities carried on within the framework of the 
licence are deemed to be safe. This we believe tends to 
weaken individual responsibility and initiative. The 
very comprehensiveness of the concept demands that 
the framework should anticipate every eventuality, 
and it must therefore descend to detail, with all the 



complexities which the operation of such a scheme 
would demand. 

68 We think that strongly interventionist licensing 
schemes have inbuilt drawbacks that make them un- 
attractive, certainly in this stage of our thinking, in 
relation to the areas with which we have been con- 
cerned. They tend for instance, to transfer respon- 
sibility from the operator to the licensing authority to 
an extent which we regard as undesirable. Not only 
does this breach the Robens philosophy which we en- 
dorse, but it tends to make those charged with issuing 
licences somewhat conservative in their approach. 
This may affect not only process changes which are 
desirable for commercial reasons but also changes 
which might have long-term implications for improved 
safety. Anyone whose duty it is to issue a licence is 
not likely to be a willing innovator. Indeed, it is 
undesirable that he should be such and the very 
nature of his duties will tend to make him discourage 
innovation in others. 

69 In the long term we believe this could be bad for 
the health and prosperity of the industries concerned 
and we would prefer the adoption of a system of con- 
trol which would not slow down innovation and 
development, but would nevertheless ensure that 
development for commercial reasons would invariably 
attract a complementary development for safety 
reasons. This will not happen unless the control arrange- 
ments are flexible enough to encompass both develop- 
ments. 

70 Strongly interventionist schemes present other dif- 
ficulties too. If detailed rules and procedures are to 
become essential ingredients of the grant of a licence, 
then those who draw up the rules and outline the pro- 
cedure cannot be less skilled than those who are to be 
expected to abide by them or carry them out. If they 
are less skilled, then the resultant sense of frustration 
which will be evoked in industry will bring the whole 
operation into contempt. 

71 Certainly at present we see no obvious surplus of 
such skilled manpower on the scale necessary to ser- 
vice schemes of this kind in the industries with which 
we are dealing. The public would be unlikely to ap- 
prove of a large growth in the number of civil ser- 
vants needed to carry out new tasks and they can in 
any case as we have already said only be drawn from 
industry itself. The result would be to denude industry 
of precisely those people most needed to guide it on 
the right lines. 

72 It is these considerations which have made us 
decide not to advocate licensing schemes of the kind 
we have described. In all our proposals we have been 
concerned that those whose skill is vital not only to 
commercial prosperity but to the safety of major 
plants should remain in industry where their vital ex- 
pertise can be fully exploited. We have said previously 
that the crucial factor in all our considerations is the 
need to ensure that proper regard to safety is shown 
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at all levels of decision-making across the whole range 
from drawing board to actual production. Safety must 
be involved in all the strategies to be employed in 
research, design, construction, maintenance and oper- 
ation. Indeed any legislative intervention should seek 
to influence the very ethos of the industry it purports 
to control. 

73 Such thoughts take us back to the main theme of 
our first report and the proposals for surveys which 
we have expanded in Chapter 2. We are dealing with 
a wide spectrum of hazards which fall within the 
broad categories we have set down. At one end are 
the large number of companies who will have to com- 
ply with our notification scheme. Of these there will 
be a smaller number who will have to submit hazard 
surveys to the enforcing authority. There will then be 
an even smaller number of installations which we 
described in our first report as the true 'major 
hazards'. We should be in a position to consider 
whether more specific control measures will be needed 
for these potentially high hazard plants when we see 
how the proposed regulations are working. 

74 We do not think that plant of the highest hazard 
should be regulated in a way which is radically dif- 
ferent from that appropriate for plants of lower 
hazard. We think that the mechanism for ensuring 
safety should not differ in kind but only in the degree 
of particularization and formality which should apply 
to the various levels of hazard. 

75 If a further degree of regulation is ultimately pro- 
ved to be necessary for these plants, we think that the 
concept of the employer having to demonstrate to the 
enforcing authority the steps taken to ensure the safe- 
ty of the operation or process engaged in, may have 
notable advantages. In the first place it would keep 
responsibility within the industry, since employers 
would have to show that they continued to operate 
the plant safely according to their own arrangements. 
We believe that as a result safety would become inter- 
woven with all decision about the management of the 
plant. 

76 Secondly, responsibility of this kind would be 
'dynamic' since (as in the case of the general duties 
under the Health and Safety at Work Act itself) the 
employer's responsibility would be open-ended, and 
he would have to update his safety procedures to 
match the developments in the process. It would be 
no defence to say that the rules had been complied 
with since it would be the employer's duty to make 
sure that the rules which he had made remained rel- 



evant and adequate to meet the hazards involved. 

77 Nevertheless, at this stage we strongly believe that 
whatever is proposed for further intervention should 
follow the same pattern that we have set for all other 
plants. Although we might wish to propose a greater 
degree of particularization and documentation, it 
would not depart from the principles which we have 
invoked in our other proposals which may be described 
in short as 'supervised self-regulation'. 

78 It would be quite wrong to suppose this would be 
a 'soft option' as regards those plants of the highest 
hazard. In order to dispel any suggestion to that ef- 
fect, Appendix 1 is an outline of the type of scheme 
we have in mind which has taken up a great deal of 
the efforts of one of our sub-groups to prepare. It 
should be immediately obvious from this Appendix 
that a scheme on these lines would require a high level 
of discipline and detailed control, but the discipline 
would be generated by the companies concerned and 
the control exercised by their managements and not 
imposed from outside. We have prepared this Appen- 
dix in the form of an outline scheme for licensing but 
it should be clearly borne in mind that in this context 
'licence' might be interpreted as 'approval' or 
'authorisation' or a 'certificate to proceed'. Some 
document would clearly have to be issued to an 
employer which would give him the right to go ahead 
but we believe this should be of the simplest form 
perhaps no more than a statement of 'no objection', 
since the supporting documentation would have to be 
provided by the employer along the lines that we sug- 
gest in the Appendix and not by the enforcing 
authority. 

79 Proposals to adopt some form of more stringent 
arrangement for plants of the highest hazard might 
raise many difficult points of detail. It would be 
necessary, for instance, to consider how the arrange- 
ments should be made to apply and what legal 
problems would be involved. For example would all 
current regulations still apply? On the face of it we see 
no reason why controls such as a Fire Certificate 
(Special Premises) Regulations 1976 should not co- 
exist with a licensing scheme along the lines we en- 
visage. We would have to consider whether such pro- 
posals should apply to existing as well as new plants. 
Above all, it would be necessary to generate criteria 
for deciding what level of hazard should attract 
special consideration beyond that which we have 
already proposed. We have not pursued these matters 
in the report as they are subjects for the future. 



4 The relationship of planning to 
major hazards 



The committee holds firmly to the view that 
the location of hazardous development 
should always be a matter for planning 
authorities. Planning controls do not how- 
ever apply to some variations in industrial 
processes which may introduce or increase 
the degree of hazard at existing instal- 
lations. In this chapter the committee in- 
vestigates the way in which the planning 
system can be applied to the siting of new 
notifiable undertakings, to the introduction 
or intensification of notifiable acitivites at 
existing installations and to the control of 
development in the areas surrounding 
notifiable installations. It is recognised that 
the implications of restrictive planning con- 
trols may involve local authorities in having 
to meet claims for compensation, and the 
proposal is made that the Secretary of State 
for the Environment should review the extent 
of his powers to make compensation 
payments in certain circumstances. Finally in 
this chapter the practical issues involved in 
consideration of siting problems are set out. 



80 In our first report we reviewed in general terms 
the application of the planning system to the siting of 
new notifiable undertakings: to the introduction or 
intensification of notifiable activities at existing in- 
stallations, and to the control of development in the 
areas surrounding notifiable installations. We stressed 
then that the siting of developments should remain a 
matter for planning authorities to determine, since the 
safety implications, however important, could not be 
divorced from other planning considerations. This 
view was received with mixed reactions: some 
respondents felt that because local planning 
authorities were not necessarily competent to judge 
technical safety issues, all decisions about potentially 
hazardous developments should be taken by central 

+ The term 'notifiable' throughout this chapter relates to the 
notification to the hse of certain types of installations having 
significant quantities of hazardous substances under the proposed 
Hazardous Installations (Notification and Survey) Regulations 
1978' recommended by the ACMH in the first report (1976). 



government. However, this appears to us to give in- 
sufficient recognition to the fact that local authorities 
are well placed to take proper account of the full 
range of local factors, including safety issues, which 
are relevant to a planning decision. 

81 We emphasized in our first report that absolute 
safety was impossible to achieve and that some 
weighing up of advantage and benefit against risk was 
inevitable. There are occasions where the advantage 
and benefit of allowing a hazardous development to 
be introduced into a particular location are sufficient 
to override the risk. Developments involving the initial 
introduction of a potential hazard or a significant in- 
crease in existing potential hazard are frequently view- 
ed by the local community as a threat to their in- 
terests - which of course include their safety. They 
naturally expect their locally elected representatives to 
look after those interests. Even when planning ap- 
plications are called in for decision by the Secretary of 
State, the planning procedures ensure that the views 
of the local planning authority are still taken into ac- 
count. Thus the planning system does give members 
of the local community the opportunity to make their 
views known, irrespective of whether the decision is 
taken by the Secretary of State or at local level. 

Scope of planning control 

82 Planning control will only apply to the introduc- 
tion of, or increase in the quantity of hazardous 
substances, if the construction or alteration of 
buildings and/or plant or a material change in the use 
of land are involved at the same time. We still hold 
firmly to the view that the location of hazardous 
development should always be a planning matter, but 
that the subsequent containment and control of a 
hazard, once there, is more appropriately and effec- 
tively dealt with under health and safety at work 
legislation. Planning conditions are not well suited to 
controlling day to day management and the detailed 
operation of activities. Planning conditions should be 
related to the proposed development itself, reasonable 
in themselves, and enforceable and no attempt should 
be made to impose conditions which are rightly the 
concern of HSE. 

The planning system 

83 Planning legislation provides that permission 
should be obtained for the 'development' of land. 
'Development' is defined in the Town and Country 
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Planning Act 1971+ as 'the carrying out of building, 
engineering, mining or other operations, in, on, over 
or under land or the making of any material change 
in the use of land'*. 

84 This definition of development is so wide that a 
vast range of activities would require express planning 
permission but for the grant of general permissions 
contained in successive General Development Orders 
(currently the Town and Country Planning General 
Development Order, 1977): these general permissions 
allow limited additions, extensions or replacements to 
be made to existing developments. Certain changes in 
use are permitted by the Town and Country Planning 
(Use Classes) Order, 1972. Some of these permitted 
developments and certain changes in use might involve 
the introduction or intensification of hazards which 
could be very significant in terms of the safety of the 
community. We recognise that a planning system can- 
not be all-embracing and that some limitations must 
be introduced if planning controls are to be kept to a 
practicable level; but we believe that the initial in- 
troduction of hazards should always be subject to 
some form of control - but not necessarily planning 
control. 

85 The way in which the planning system can be 
used for the control of hazards varies with the cir- 
cumstances and type of development, and it is 
necessary to consider three separate situations: 

1 the introduction of potential hazard as part of 
the development of 'green field' sites; 

2 the first introduction of potential hazard to 
existing installations; 

3 the intensification of hazard at existing 
installations. 

We also have to consider the problems arising from 
proposed and existing uses of land in the vicinity of 
hazardous undertakings. 

86 In all these situations it is important that any 
safety implications are recognised by the local author- 
ity at an early stage and that technical guidance as ap- 
propriate is available. Where major developments are 
concerned, the prospective developer normally holds 
informal discussions with the local planning authority 
and HSE before submitting a formal application for 
planning permission. Such discussions provide an op- 
portunity for consideration of the safety implications 
from the outset. However, several of the responses to 
our first report mentioned difficulties encountered by 

t In this chapter all references are to the Acts and Statutory In- 
struments which are applicable in England and Wales. The rele- 
vant Scottish Acts and Statutory Instruments, while separate, are 
for practical purposes identical and the views expressed by us 
apply of course to Scotland as to England and Wales. 

♦Chapter 1 mentions that the committee is considering to what ex- 
tent pipelines are to be subject to the proposed Hazardous In- 
stallations (Notification and Survey) Regulations. It should be 
noted that except for local pipelines (those under 10 miles in 
length) there are separate planning procedural arrangements for 
the processing of pipeline proposals and these differ according to 
the nature of the particular development. 



planning authorities in identifying applications that 
could involve or be affected by hazardous activities. 
The statutory notification scheme referred to in Chap- 
ter 2 will provide a means of reducing this problem. 

87 Planning authorities themselves can help to 
reduce the possibility of notifiable hazards being in- 
advertently overlooked by the adoption of the question 
about hazardous activities set out in the model forms 
of application for planning permission. All that 
need be provided at the outline stage is a brief 
description of the development and a plan outlining 
the site, but the planning authority can, if they con- 
sider it necessary, require further information about 
the development beyond that set out in the application 
form. We consider that it would also be useful in this 
context, and render the statutory notification 
scheme even more effective, if developers were re- 
quired to inform the local (planning) authority that a 
notification had been sent to the HSE and we recom- 
mend this accordingly. 



Initial introduction of hazards to 'green field' sites 
88 Provided the hazard implications are fully 
recognised, following implementation of the recom- 
mendation in paragraph 87, the introduction of 
hazards as part of the initial development of a 'green 
field' site will be adequately controlled, because the 
developer requires planning permission either for the 
material change of use or for the construction work 
involved. Permission for some developments is sought 
on a two stage basis - 'outline' first and 'detail' later. 
An outline permission, once granted, is in all senses a 
planning permission. The only matters not dealt with 
(termed 'reserved matters') might include those 
relating to siting, design, external appearance of the 
buildings, landscaping of the site, and the means of 
access thereto. All or most of these might not have 
been supplied with the initial application, but would 
be submitted for approval subsequently. In consider- 
ing an application for approval of details, the plan- 
ning authority can only deal with reserved matters; they 
cannot impose any new restriction on the development 
other than that relating to the reserved matters. It is 
therefore essential that any restrictions or conditions 
which they wish to attach to the use of the land 
should be imposed when the outline permission is 
granted. The combined effects of the steps discussed 
in paragraphs 86 and 87 for providing better inform- 
ation to local authorities should in due course provide 
a means of ensuring that the introduction of hazards 
to new developments or to major redevelopments will 
from the outset be recognised and considered by the 
planning authority. However in furtherance of this 
aim, we also recommend that local planning 
authorities should impose a standard condition pro- 
hibiting without specific consent the introduction of 
notifiable hazards at a later date on all planning per- 
missions of an industrial nature. 
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Initial introduction of hazards to existing installations 

89 During the past forty years and with increasing 
frequency, significant hazards have been introduced 
into existing installations particularly as a consequence 
of the pressure to improve efficiency and to take ad- 
vantage of advancing technology. Many of these in- 
stallations were constructed before planning controls 
existed. We have already noted that the introduction 
of a hazard unaccompanied by development does not 
require planning permission, although in some cases 
where the Explosives Act 1875 or the Petroleum (Con- 
solidation) Act 1928 and its Orders apply, a licence 
will be required. Even in cases where additional plant 
or building operations are involved, the occupier 
might be able to avail himself of one or more of the 
general permissions referred to in paragraph 84. 

90 Thus, in practice, planning permission is needed 
when it is proposed to construct additional plant or 
buildings beyond the permitted limits of the General 
Development Order or when planning conditions re- 
quiring further applications to be made have already 
been imposed in the past - which will not often be the 
case. Authorities when granting permission for in- 
dustry, warehousing or storage, have not always an- 
ticipated the possibility that a hazardous activity may 
one day be introduced there. Comments on our first 
report indicated that planning authorities were con- 
cerned at the lack of planning control in this area. 

91 We are of the opinion that the introduction of a 
notifiable hazard at an existing installation, or a 
change of use, should be capable of control so as to 
provide the local community with an opportunity of 
deciding whether they are prepared to accept the in- 
troduction of that hazard. We have therefore reviewed 
the appropriate parts of the present system of 
development control with a view to identifying ways 
in which this could be achieved. 

92 In theory it might appear that extending the 
definition of development in Section 22 of the Town 
and Country Planning Act 1971, quoted in paragraph 
83, so as to include the initial introduction of a 
notifiable activity, and thereby making planning per- 
mission a prior requirement would provide a way. But 
this radical approach, although not beyond the realms 
of possibility in the longer term, will not provide a 
ready answer now. We are advised that there are con- 
siderable practical difficulties about securing amend- 
ment to the Act because the definition of develop- 
ment is in very broad terms and has been the subject 
of many judicial decisions and it may be difficult, if 
not impossible, to confine amendment of the definition 
to matters which are the concern of this committee. 
We have therefore examined alternative measures 
which may be more easily attainable. 

93 One of the alternatives, put forward by some 
respondents to our first report, would be the creation 
of a new use class in the Use Classes Order. However 
such an addition would not provide effective control 



because the purpose of the Use Classes Order is to 
reduce the need to make planning applications by per- 
mitting certain changes in use without specific permis- 
sion. The intention of these respondents would, in 
fact, be better achieved by the express omission of 
'notifiable activities' from the Use Classes Order 
altogether. This would enable local planning 
authorites to require applications to be submitted in 
respect of the introduction of notifiable activities at 
existing installations. 

94 We have also considered the extent of permitted 
development available to operators of existing in- 
dustrial installations under Article 3 of the Town and 
Country Planning General Development Order 1977 
especially through Class VIII of Schedule I which 
covers development for industrial purposes. Article 3 
provides that the permission granted by the Order in 
respect of any class of development shall be defined 
by any limitation and be subject to any condition im- 
posed in Schedule I in relation to that class. We 
therefore suggest that an appropriate limitation be in- 
serted into Class VIII which would have the effect of 
excluding additions or replacements of plant or 
machinery or structure or erections of the nature of 
plant and machinery, or the extension or alteration of 
buildings, intended to be used for the purposes of a , 
notifiable installation. 

95 Another and alternative approach to these 
amendments to the Town and Country Planning 
subordinate legislation would be the institution of 
some form of additional control, entirely separate 
from planning legislation, to deal with the introduc- 
tion of hazards at existing undertakings. For example, 
analogous controls are those exercised separately from 
planning legislation, e.g. licensing of explosives stores, 
liquor licensing and betting licences (licences are 
granted by the magistrates courts while planning per- 
mission for the buildings or change of use is given by 
the local planning authority). A control separate from 
planning legislation would be preferable to no control 
at all, but it appears to us to be a far less satisfactory 
solution since it might result in decisions being made 
without due regard to relevant land use planning con- 
siderations. 

96 Of the courses mentioned in paragraphs 92 to 95 
an alteration to the definition of development in the 
1971 Act seems the most effective way, if it can be 
done. The suggested amendments to the Use Classes 
Order and the General Development Order discussed 
in paragraphs 93 and 94, however, would in practice 
provide a reasonable measure of additional control 
particularly after the notification regulations come in- 
to force. They would also be more easily im- 
plemented. We recommend that these changes should 
be made without prejudice to consideration of the 
proposal to amend Section 22 when such an oppor- 
tunity occurs. 

97 The effectiveness of any legislation ultimately 
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depends on its enforceability. It is not an offence to 
carry out development or make a material change of 
use without first obtaining planning permission, but 
an offence arises when an enforcement notice takes 
effect. The local planning authority have complete 
discretion to decide whether or not it is expedient to 
serve an enforcement notice. Thus in the final analysis 
the efffective enforcement and application of planning 
controls depends upon fairly easily detectable and out- 
wardly visible breaches of control coming to the atten- 
tion of the authority. This remains a problem as far 
as the local authority is concerned but the HSE hold 
and exercise a right of entry and can draw appropriate 
matters to the attention of the local planning authority. 
The results which we desire may be obtainable by 
other means including those powers operated by the 
HSE Inspectorates. As far as planning control itself is 
concerned, this state of affairs, in our view, reinforces 
the argument for making the recommendation, in 
paragraph 88, that planning authorities should con- 
sider the imposition of the recommended standard 
condition when granting planning permission for any 
type of industrial development, to prohibit any subse- 
quent introduction of a notifiable activity. 

Intensification of hazard at existing installations 

98 The most common forms of hazard intensifica- 
tion involve increases in the quantity of hazardous 
substances stored or the introduction of a substance 
which is more hazardous than its predecessor. Some 
changes may increase the threat to the local commun- 
ity. Some changes will have no planning significance; 
others will require planning permission because of 
associated development. However in all situations the 
local community, through the decisions of its planning 
committee, should have had the opportunity of ex- 
pressing a view on the principle of introducing, into 
its midst, a potentially hazardous activity. Provided 
therefore that the local authority has previously been 
given this opportunity, intensification of hazard, be- 
ing a complex and technical matter on which the plan- 
ning committee will lack expertise, could be more ap- 
propriately dealt with under health and safety legis- 
lation unless, of course, development is involved. 

99 However it is essential that planning authorities 
are made aware of significant proposed hazard inten- 
sification to enable them to have regard to the new 
situation when proposals for development in the 
vicinity are under consideration. Accordingly we 
recommend that HSE should inform planning 
authorities of any intensification of existing hazards 
notified to them under the proposed regulations. 

Proposed development in the vicinity of notifiable in- 
stallations 

100 Planning authorities will have to consider at the 
outset the need to restrict incompatible new develop- 
ment from encroaching too near to a notifiable in- 
stallation and in this regard there are several precau- 



tionary steps open to an authority. 

101 Firstly, it can enter into agreements with the 
owner or occupier of the land for the purpose of 
restricting the use of the land (Section 52 of the 1971 
Act). Alternatively, the planning authority might be 
able to agree with the operator of the notifiable in- 
stallation, or the prospective operator of a proposed 
notifiable installation not yet in operation (but they 
have no power to compel him to do so) that he should 
ensure control over the use of land surrounding his in- 
stallation. Or again, the planning authority might be 
given an indemnity by the operator or prospective 
operator of the notifiable installation in the event of 
the local authority having to pay compensation or 
meet the cost of a purchase notice served on the plan- 
ning authority under Section 180 of the 1971 Act as a 
result of any planning decision taken on safety 
grounds to the benefit of the installation. Whether or 
not the operator or prospective operator of the 
notifiable installation would see such an arrangement 
and the corresponding commitments as fair and 
satisfactory to him will clearly depend on the circum- 
stances of the case. 

102 One of the main objectives of planning controls 
is to ensure that incompatible land uses are kept 
apart. In our view any proposed development or 
redevelopment involving a significant increase in the 
population in the vicinity of a hazardous undertaking, 
must be carefully examined to see whether the nature 
and situation of the development renders it incompat- 
ible with its surroundings. We recognise that it is not 
easy to define "in the vicinity" as a precise distance 
because the areas potentially at risk from an install- 
ation vary considerably from case to case. Greater 
precision may be possible as knowledge of the conse- 
quences of loss of containment is built up through ex- 
perience and research. In the meantime HSE may sug- 
gest precise distances in order to set up working ar- 
rangements with planning authorities, but the ar- 
rangements should be sufficiently flexible to enable 
planning authorities to seek advice whenever they feel 
in doubt. 

Existing development in the vicinity of notifiable in- 
stallations 

103 The gradual build up of information about the 
location and nature of undertakings having notifiable 
hazards may well bring about reviews by some plan- 
ning authorities of existing land uses which involve or 
are affected by such undertakings. Where changes in 
the undertakings are planned there may be an oppor- 
tunity to reduce the hazard and the chances of its 
potential being realized. Planned redevelopments in 
the vicinity of the undertakings may present an oppor- 
tunity to reduce the number of people at risk. Where 
there is no early prospect of redevelopment, the local 
planning authority is faced with the decision of either 
accepting the risk or making a discontinuance or a 
modification order. 
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Revocation, discontinuance and modification orders 
and compensation 

104 Straightforward refusal of planning permission, 
because, for example, a proposed site for a new in- 
stallation is too near to existing or other proposed 
developments with which it would be incompatible or 
for any other good reason, does not give rise to any 
claim for compensation. Likewise if in granting per- 
mission an authority imposes conditions, including 
conditions restricting the further extension of the in- 
stallation which might otherwise be permitted under 
the GDO, or prevents changes in use which might 
otherwise be permitted under the Use Classes Order, 
again such conditions would not render the local plan- 
ning authority liable to claims for compensation. But 
there is a right of appeal to the Secretary of State 
against conditions unacceptable to the applicant. 

105 In some instances a refusal or conditional grant 
of planning permission might lead to a purchase 
notice being served on the planning authority by the 
prospective developer (Section 180 of the 1971 Act). 
This only arises in a very limited set of circumstances, 
namely where it can be shown that the land has 
become incapable of reasonably beneficial use. If the 
planning authority accept the purchase notice, or it is 
confirmed by the Secretary of State, the local auth- 
ority will be obliged to buy the land. Again where 
following a direction under Article 4 of the GDO a 
planning application must be submitted in respect of 
development which would otherwise be permitted 
under the GDO (see paragraph 84 above), Section 165 
of the 1971 Act provides for compensation to be paid 
on the extra cost incurred or on any loss in value or 
damage sustained which is directly attributable to the 
refusal of planning permission or conditions attached. 

106 The grant of planning permission does not 
represent the last opportunity for a local planning 
authority to influence a development in its area. 
Following the grant of a planning permission, but 
before it has been implemented, the permission can be 
revoked for example as a result of a change of plan- 
ning policies for an area or because of new inform- 
ation coming to light which was not available when 
permission was granted. Furthermore, in exceptional 
circumstances, the local planning authority may even 
consider it expedient to bring an existing use to an 
end or to secure some measure of control over it. 
Compensation is payable and the sums of money in- 
volved depend on the nature and scale of the develop- 
ment being restricted but they could be very substan- 
tial indeed. 

107 We note in all these circumstances it is the local 



planning authority alone which is liable as a conse- 
quence of those decisions taken in the interest of 
public safety unless they have made other agreements 
with developers (see paragraph 101 above). We note 
also that the Secretary of State has, in certain situa- 
tions only, discretion to make contributions to local 
authorities if compensation is payable. We consider 
that the circumstances in which such payments might 
be made should be identified; we believe that this 
might reveal a need to extend the discretionary powers 
given to the Secretary of State. We accordingly 
recommend that the Secretary of State should review 
the extent of his discretionary powers to make 
payments in certain circumstances. 

Application of siting policies by planning authorities 

108 Consideration of siting problems is far from an 
exact science; it is one where the best information 
available must be examined and a judgement formed. 
It always has to take account of the situation as it 
exists. We learn that HSE is frequently asked to com- 
ment on development proposals relating to an installa- 
tion set up in a far from ideal location at a time when 
consultation arrangements did not exist. In these cir- 
cumstances we are told that the HSE has to bear in 
mind to what extent the development proposals repre- 
sent an improvement on the existing situation. The 
HSE is also frequently asked to comment on proposals 
to develop or to redevelop land in the neighbourhood 
of an existing hazardous undertaking where there may 
already be other land users which are closer and 
possibly incompatible. In these cases HSE tell us that it 
takes the view, which we fully endorse, that the ex- 
istence of intervening development should not in any 
way affect the advice that it gives about the possible 
effects of that activity on proposed develoments which 
may appear to be less at risk than the existing ones. 

In other words the existing situation should never be 
regarded as providing grounds for failing to draw at- 
tention to the implications for development at a 
greater distance. 

109 These fundamental difficulties may make it in- 
evitable that any future siting policy can be expressed 
only in very general terms since so much depends 
upon the appraisal of the individual circumstances of 
each case. The overall objective should always be to 
reduce the number of people at risk, and in the case 
of people who unavoidably remain at risk, to reduce 
the likelihood and the extent of harm if loss of con- 
trol or of containment occurs. As knowledge of the 
behaviour of hazardous activities grows and appraisal 
techniques are improved the expertise of HSE in this 
field will develop considerably. 
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5 Explosion hazards 



In recent years increasing effort and 
resources have been devoted to searching for 
a better understanding of the formation, 
behaviour and explosion of vapour clouds. 
The committee reviews the evidence that they 
have been able to obtain and discusses the 
sources, characteristics and factors that af- 
fect the magnitude and destructive effect of 
vapour cloud explosions. 

110 It was a major explosion at Flixborough which 
led to the setting up of our committee and it was to 
be expected that following our first report we should 
pursue this area of our enquiries in detail. One of our 
working groups, in particular, has studied the subject 
of unconfined vapour cloud explosions* in some 
depth, and has been greatly helped by close consult- 
ation with the Chemical Industries Association's 
Chemical Industry Safety and Health Council at 
several joint meetings, and by the willing cooperation 
of many other individuals and organisations. We 
recognise that for decades the hazards which arise 
from conventional explosives such as gunpowder, 
nitroglycerine, TNT, RDX, and the like, have been well 
understood. Consequently the manufacture and use of 
such materials have been strictly controlled by specific 
and detailed safety measures such as compartmen- 
talisation of the individual stages of the process, 
mounding and barricading, minimising of inventories 
and severe limitation (or even elimination) of man- 
ning. In contrast the possibility that a large cloud of 
flammable vapour mixed with air could give rise to an 
explosion in the open was treated with considerable 
scepticism, until comparitively recent times. Today 
there is indisputable evidence that large clouds of 
flammable vapours mixed with air can give rise to ef- 
fects which in some though not all respects are dif- 
ficult to distinguish from the detonations* of high ex- 
plosives. 

111 In recent years increasing effort and resources 
have been devoted to searching for a better understan- 
ding of the formation, behaviour and explosion of 
vapour clouds and we have reviewed the evidence that 
we have been able to obtain. Our work has been 
assisted by a recent study of the problem by 
Marshall" but is must be said at the outset that the 
*See Glossary 



information is far from complete or conclusive, and 
will inevitably remain so for many years to come. 
Thus the conclusions and recommendations in this 
chapter are interim in nature. 

112 In Chapter 1 we referred to Strehlow's 5 survey 
of vapour cloud incidents. In 1972, he listed no fewer 
than 108 incidents in the previous forty two years 
mainly in the USA but also in Germany and Holland: 
none had occurred in the UK. The alarming increase in 
the frequency of such incidents from four in one 
decade to a rate of over sixty per decade (largely due 
to the increase in the number of large plants) is il- 
lustrated in Fig 2. Since 1972 there have been dis- 
astrous vapour cloud explosions at Flixborough and at 
Beek in Holland. Detailed investigations were made in 
both cases and reports 12 ' 13 have been published. 

113 The clouds which have been generated in recent 
history have been by any standards very large indeed. 
That which formed at Flixborough was probably 
about 0.5 x 10 6 cu metres in volume. (By comparison 
St Paul's cathedral has an internal volume of about 
0.2 x 10 6 cu metres.) In view of these magnitudes, it 
is hardly surprising to find that the destruction caused 
at Flixborough for example has been estimated 12 as 
comparable with that due to amounts of TNT in the 
range of 10 to 45 tonnes. These figures have been 
refined in more recent work 14 to 16± 2 tonnes. 

Sources of unconfined vapour explosions 

114 Flammable liquids stored in bulk at atmospheric 
temperature and pressure may, if containment is 
breached, give rise to fire, but are most unlikely to 
produce a large cloud of flammable vapour which on 
ignition would explode. Liquefied gases stored under 
refrigeration at atmospheric pressure have to be given 
much more serious consideration. If on loss of 
primary containment the cold liquid finds secondary 
containment in such a way that the rate of heat 
transmission from the surroundings is low, it is again 
unlikely that a large cloud of flammable vapour 
would be produced, and fire is the most likely danger. 
However if the cold liquid were to be released over a 
large area of land or a large expanse of relatively 
warm water it might, depending on the temperature 
difference, the properties of the cold liquid and the 
detailed nature of the surroundings, evaporate at such 
a rate that a large and dangerous cloud would form. 
The most serious danger of all, however, would arise 
from loss of containment of a flammable gas, or of a 
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flammable vapour when stored under pressure in 
equilibrium with its liquid phase. 

The magnitude of the explosion hazard 

115 The estimation of the magnitude of a vapour 
cloud explosion and of its destructive effect at any 
particular location, depends upon a number of factors 
which are listed below: 

(a) Inventory of flammable material 

(b) Fraction likely to flash off to form vapour 
cloud 

(c) Composition of ensuing cloud 

(d) Dimensions of the cloud 

(e) Extent of cloud drift 

(f) Likelihood that cloud will give rise to explosion 

(g) TNT equivalence* or other measure of blast 
effect 

(h) Relationship of overpressure to distance from 

epicentre* 
(i) Duration* of overpressure 

Inventory of flammable material 

116 In the case of a storage tank this may be ob- 
vious enough. A plant may, however, consist of semi- 
independent units, and a loss of containment from 
one may or may not lead to significant escape from 
others. It may be possible to provide isolating valve 
systems which must be designed to 'fail-safe'. In any 
given plant, therefore, it will be necessary to estimate 
the inventory in total, or for each unit or group of 
units which can in an emergency be isolated very 
rapidly and preferably by remote or automatic con- 
trol. 

Fraction likely to flash off to form vapour cloud 

117 If the flammable material is a gas the answer 
may be obvious, but if it is in the form of a liquid in 
equilibrium with its vapour at elevated pressure it is 
far from obvious. The location of the opening will 
determine whether boiling liquid, or vapour with or 
without entrained liquid or froth are ejected. As soon 
as the material escapes to atmosphere the liquid will 
'flash off a quantity of vapour ■ 'the theoretical 
flash' - which can be calculated from such factors as 
the original pressure and the specific and latent heat 
of the material. It has been argued that the whole of 
the release should be assumed to be transformed into 
a cloud of vapour and, indeed, in one Japanese ex- 
periment's in which ethylene was deliberately released 
through a 25 cm bursting disc at the top of a vessel 
containing 718 kg at a pressure of 8.3 atm, 620 kg 
was ejected in the form of a gaseous/liquid mixture in 
6.5 seconds. To avoid an explosion it was deliberately 
ignited at exit, so causing a huge expanse of flames 
about 100 m in length and a 'fireball' some 40 m in 
diameter. 

*See Glossary 



118 The amount of the ejected liquid which will be 
entrained with the vapour and the size of the entrain- 
ed droplets will depend on many other factors such as 
the physical properties of the liquid and the geometry 
of the opening. A small orifice would give fine 
droplets, but to produce a large vapour cloud a large 
opening is needed, and this would encourage the pro- 
duction of relatively large drops which might not re- 
main in the cloud but could soon fall to the ground. 
It seems rational to suppose, however, that had igni- 
tion not been engineered, in the Japanese experiment 
quoted above, less than the 620 kg released might 
have mixed in the form of vapour with air to form a 
mixture in the explosive range. 

Unless information is availabe which enables a more 
precise calculation to be made for a particular case, 
we suggest that the amount of spray in the cloud 
which takes part in the explosion can for most pur- 
poses be assumed to be equal to the theoretical flash; 
in other words, that the total effective mass of vapour 
in a cloud be estimated at twice the theoretical flash 
provided this does not exceed the total inventory. 

Composition of ensuing cloud 

119 It is impossible, in general terms, to predict the 
composition of the resulting cloud. It will depend on 
the position and totally unpredictable geometry of the 
opening which allows the material to escape, the con- 
dition, pressure and density of the material released, 
the atmospheric conditions at the time, and the in- 
fluence of surrounding plant and buildings. The cloud 
will almost certainly be heterogeneous in composition 
with a centre core very rich in vapour, an outer layer 
lean in vapour and an intermediate zone where the 
composition lies within the explosive range. Because 
of poor mixing there will inevitably be localised 
pockets of varying composition throughout each of 
the zones. Initial ignition will produce turbulence that 
may make the cloud more homogeneous and more 
dangerous; temperature rises will widen the explosive 
range. 

Dimensions of the cloud 

120 Although any estimates of size and shape of the 
cloud are necessarily very tentative indeed, it is 
reasonable, if only to estimate its volume, to assume 
that its mean composition is stoichiometric. This 
volume can be expressed in cubic metres, or more 
vividly by quoting the diameter of an equivalent 
sphere, but seldom, if ever, will such clouds approx- 
imate to a spherical shape, and many of the clouds 
which are of concern will be formed from hydrocar- 
bon vapour much denser than air. In these cases the 
cloud is likely to take such a shape as an oblate 
hemispheroid. If, for the sake of illustration, a ratio 
of cloud radius to cloud height of 5:1 is assumed (and 
there is some evidence that this is in reasonable accord 
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with past experience)* a rough estimate can be made 
of the cloud radius R as 
R = 30VM 

where R is in metres and M the mass of vapour in 
tonnes. " Perhaps the most important lesson to be 
derived from such crude calculations is the degree to 
which a vapour cloud explosion must differ from one 
at some imaginary 'point source'. 

Extent of cloud drift 

121 Clouds will drift with the wind. Pasquill's and 
other existing theoretical methods for predicting the 
dispersion of vapour do not seem to be completely 
valid when applied to heavy vapours, and, since the 
subject is of vital importance in relation to the 
dissemination of toxic gases appropriate experimental 
work has been put in hand*. Experience indicates that 
the vapour clouds which are most likely to explode 
are those which have formed rapidly. Because the at- 
mospheric conditions at the time are quite unpredict- 
able, there is little option but to ignore the effect of 
drift except perhaps by placing sensitive parts of the 
plant, as far as possible, upwind of danger spots in 
relation to the prevailing wind direction. 

122 In passing, it might be worth noting that the 
epicentre of the Flixborough explosion has been 
estimated to have been some 30 metres from the point 
of escape but that this displacement was not in the 
direction of the wind but was at right angles to it. The 
displacement may have arisen as the result of the 
velocity of the escaping cyclohexane or of the in- 
fluence of buildings or plant in the vicinity (Fig 4). 

Likelihood that cloud will give rise to explosion 

123 The enormous difference between the effect of 
the extremely rapid burning of, say, a gun propellant 
such as cordite, which may take two or three milli- 
seconds to reach maximum pressure, and the truly 
shattering effect of the detonation of a high explosive 
such as TNT, which occurs in microseconds, is well 
known. That in the combustion of confined gaseous 
mixtures there is a similar discontinuity is illustrated 
by 'pinking' or 'knocking' in a petrol engine, which if 
severe and allowed to persist will damage it, on oc- 
casion even shattering the pistons. It may seem im- 
probable that any similar phenomenon could occur in 
an unconfined vapour cloud, but it is certainly poss- 
ible to induce deliberately by using high explosive a 
true detonation in an unconfined mixture of ethylene 

+ According to recently-published paper by Sadee et al 14 the mass 
of cyclohexane which escaped at Flixborough was of the order 40 
tonnes, so our. estimated radius of the hemispheroidal cloud would 
be 102 metres, and height 20 metres. From this same paper fig 4 
has been reproduced, showing the authors' estimate (on the basis of 
the carbonization, melting, and soot formation observed after the 
disaster) of the plan boundary of the cloud. The deviation from a 
circular shape is of course very great ■ in view of the obstructions in 
the shape of buildings and the existence of a wind it could hardly 
be expected to be otherwise - but the minimum radius of their 
boundary is 70 metres, the maximum 175 metres, and the mean 
Radius (i.e.\/"area/rt) is 110 metres. 
Chapter 8 



oxide and air, so the possibility cannot immediately be 
ruled out. We know of only one accidental uncon- 
fined hydrocarbon explosion where responsible in- 
vestigators have claimed that a detonation occurred; 
that at Port Hudson in 1970. According to Strehlow' , 
"550,000 cu ft (STP) of propane gas" (about 31 ton- 
ne ~)Teaked from a pipe before ignition occured, 13 

minutes later The Port Hudson explosion is a 

proven example of an accidental vapour cloud det- 
onation. " According to Burgess and Zabetakis 16 in a 
much fuller report, the leakage consisted of "about 
750 barrels of liquid propane" (say, 70 tonnes) during 
twenty four minutes before the explosion occurred, 
and in their introduction they state that "this explo- 
sion was unique in the investigators' experience in 

that it involved the detonation of a large unconfined 
cloud." In the body of the report, however, they say: 
"Judging from such damage" (which they illustrate) 
"and the abruptness of the illumination of the 
valley, we think the witnesses had the unusual ex- 
perience of observing a gas detonation." Such 
evidence in our opinion does not amount to a 
justification of the statement in their introduction, 
still less to Strehlow's use of the word 'proven', and 
since no other single case is on record, and many 
deliberate attempts to detonate unconfined hydrocar- 
bon/air clouds have failed, it would seem more 
justifiable to regard the occurrence of true detonation 
in an unconfined vapour cloud as so improbable as to 
be disregarded for design purposes. 

124 That the combustion of vapour clouds may take 
the form of 'explosions' cannot, however, be 
doubted. True, in the case of relatively small clouds it 
is not always easy to distinguish between fire and ex- 
plosion: ignition may be accompanied by a loud noise 
and people may be hurled to the ground without any 
other evidence of blast, such as shattered windows, 
appearing. In the case of large clouds, such as that at 
Flixborough, the resulting damage quite certainly has 
been due to a shock wave or 'overpressure' of con- 
siderable magnitude. Some of the most serious in- 
cidents which have occurred in the last half-century 
have been tabulated in Chapter 1, Table C. From this 
it is clear that for very large clouds, containing say, 
more than 15 to 20 tonnes of gas or vapour before ig- 
nition, the risk of explosion is so great that it would 
be foolhardy in the extreme to proceed on any 
assumption other than that in such cases an explosion 
will occur. Explosions have occurred with smaller 
amounts, but it must be remembered that many other 
similar recorded escapes have either not ignited or if 
ignited have not exploded, and very many more must 
have occurred without even being regarded as 
newsworthy. It would seem unreasonable to argue 
that every such release should be regarded as a major 
explosion hazard. It seems clear that, until further 
evidence becomes available either from deliberate ex- 
perimentation or as the result of further accidental 
releases of a range of flammables, some sort of sen- 
sible compromise should be adopted. In our first 
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report we suggested that if 15 tonnes of vapour could 
be released an installation should be regarded as of- 
fering a major explosion hazard, and we have not 
found cause to change our view. 

TNT equivalence or other measure of blast effect 

125 The question of the yield of an explosion in 
terms of blast effect is still largely unresolved. The 
complete combustion of a stoichiometric hydro- 
carbon/air cloud releases a total amount of energy 
equivalent to about ten times the explosive energy of a 
mass of TNT equal to the mass of hydrocarbon in the 
cloud, but the fraction of this energy manifest in blast 
effects is critically dependent on the rate of combus- 
tion in the cloud. It may be zero, as in a fire, or it 
may be as high as 0.3. It has been estimated that 
flame speeds of the order of 100 m/s are required 
before pronounced blast effects develop. 

126 In a real situation, only a fraction of the release 
will be in the flammable portion of the cloud, as 
discussed in paragraph 119, and only this flammable 
portion of the cloud can contribute to an explosion 
(the lean portion will not burn; the rich portion will 
contribute to the ensuing fire). The blast energy 
resulting from the rapid burning of this flammable 
portion will depend on many factors such as the ig- 
nition source, the degree of containment of different 
parts of the flammable volume, turbulence generated 
by flow round obstacles and other factors that have 
been mentioned in the preceding paragraphs. 

127 It is in no sense surprising to find that the frac- 
tion of combustion energy available in the material 
released from containment which appears as explosive 
energy varies between about 0.01 and 0.1. The majority 
of serious incidents which have occurred in the past 
have been in the lower end of this range. Surveys 
made in 1968" and again by two independent in- 
vestigators in 1977 6>18 show that major vapour cloud 
explosions have in practice developed between 0.01 
and 0.03 of available energy. 

128 It is worthwhile to emphasize, in passing, that 
we cannot ever hope to reach an accurate answer even 
by deliberate experimentation: the variables are quite 
beyond control and impossible to assess in general 
terms. As accidents continue to happen throughout 
the world, it may be possible to reduce the range of 
uncertainty, but even this is more than doubtful. In 
our opinion, this is another aspect which requires a 
sensible compromise to be made in order to avoid 
taking extremely pessimistic values so giving rise to a 
design which covers unrealistically low probabilities of 
occurrance. We suggest that the explosive energy in a 
vapour cloud should be assumed to be 0.03 of the 
available energy. In pragmatic terms, this means that 
the TNT equivalent of a vapour cloud can be estimated 
at 0.3 tonnes of TNT for every tonne of vapour and 
spray which makes up the cloud. 

129 When considering this figure, it must be borne 
in mind that since the distance at which a given 



amount of damage is caused by an explosion varies as 
the cube root of the quantity of explosive, it is of 
course relatively insensitive to variations in the 
calculation of the equivalent mass of TNT. For in- 
stance, even a doubling of the assumed efficiency of 
explosion would alter the predicted damage radius by 
only 26%. 

Relationship of overpressure to distance from 
epicentre 

130 The major advantage of using 'TNT equivalent' 
as a model lies in the considerable amount of data 
amassed on the effects of TNT explosions; data which 
are unclassified for security purposes and available for 
use. One such set of data, based on well-established 
information" , and here summarised by plotting a 
graph of 'side -on peak overpressure'+ versus 'scaled 
distance'*, is shown in Fig 5, by the solid curve, 
labelled "Basic curve for TNT". From this curve, if 
the TNT equivalent of the explosion is known and if it 
may be assumed that an unconfined vapour cloud ex- 
plosion gives the same relationship, it is easy to read 
off the overpressure at any distance from an assumed 
epicentre. There must, however, be enormous dif- 
ferences between the explosion of TNT and an uncon- 
fined vapour explosion. Apart from the difficulty of 
determining the effective epicentre, which is unlikely 
to coincide with the centre of the cloud but is more 
likely to be displaced away from the initiating ignition 
point, there is the obvious fact that the original cloud 
is very large in volume compared with the equivalent 
mass of TNT which can from this point of view be 
regarded as a point source. It will have been noticed 
that the curve in Fig 5 shows no upper limit of over- 
pressure. The theoretical upper bound might however 
be expected to be related to that pressure which would 
be achieved if a mass of TNT after detonation could 
be confined under adiabatic conditions within its 
original boundaries. The resulting detonated mass 
would then produce a pressure of about half a million 
bar. In sharp contrast, the maximum pressure arising 
from confinement under adiabatic conditions within 
the initial volume of a vapour cloud would not be ex- 
pected to exceed about 8 bar 19 . In consequence, it is 
hardly surprising to find that the vapour cloud explo- 
sion is relatively 'soft'* in other words that the shatter- 
ing effect, and the velocity of any missile which may 
be generated, are relatively small. 

"I" We are here discussing a complicated situation involved in the 
passage of a shock wave over an obstacle. There is no universally 
accepted agreement of the descriptive terms which can be used. 
These can be found in the Glossary. It is however, worthwhile to 
add at this stage that if a shock wave strikes a surface perpen- 
dicular to it the pressure developed on the reflection at the 
surface will be very much higher - from 2, to in an extreme 
case, 8 times the 'side - on peak' overpressure. In the cases 
we have to consider the factor will be of the order 2.5 to 3. 
See Glossary 

*At Flixborough, for instance, no crater was produced such as 
would have been caused by an explosion of TNT at ground level, 
nor was the plant at the cloud centre damaged nearly so severely 
as it would have been, had the quantity of tnt been exploded 
there which would have been required to cause the distant 
damage. 
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131 In both cases, the practical upper limit of over- 
pressure will be some fraction of the theoretical maxi- 
mum suggested, and it is not unreasonable to sup- 
pose, in view of the great difference in time scale, that 
the fraction would be much smaller in the case of the 
vapour cloud than in the case of high explosive. In- 
deed, although large-scale research would be required 
to determine the upper limit of overpressure due to an 
unconfined vapour cloud explosion, such data as exist 
suggest a value of 1 bar, and this we have accepted as 
our best estimate of the overpressure near the middle 
of the cloud. It seems rational to assume that this 
pressure will be somewhat less at the edges of the 
cloud, and we have taken the value of 0.7 bar as 
reasonable for this region. Since, as we argued in para 
123, detonation is highly improbable, it would seem 
that construction of a building to withstand such 
pressures is a practical proposition. 

Duration of overpressure 

132 The peak value of the overpressure is not the 
only factor which determines the destructiveness of an 
explosion; duration is no less important, and the 
resulting impulse* probably more important than 
either. We know that in the case of the detonation of 
high explosives the blast wave* at a modest distance 
usually takes the form of an almost instantaneous 
pressure rise to the peak value, say P[, followed by a 
steady decay to zero after time t Q (and subsequently 
to a negative value, the total impulse Jpdt being 
approximately zero). The value t depends on the 
amount of explosive detonated, and varies at least 
from about 1 ms for a very small charge to about 50 
ms for a large one and 250 ms for an extremely large 
one. We have no comparable reliable information 
about vapour cloud explosions. We have no reason 
even to assume that the shock waves will be very 
similar in form. Because of the difference in time 
scales which must exist, it is fairly certain that the 
duration will not be short: on the other hand, because 
of the magnitudes involved it is equally certain that 
the duration will not approach the uppermost figure. 
Indeed, the longest estimate of which we have 
knowledge is 75 ms, but this figure has been chal- 
lenged. Until more information is available, we sug- 
gest that an estimate of 30 ms be accepted. 

Vapour clouds and high explosives 

133 In attempting to sum up the preceding dis- 
cussion it must once again be emphasized that we 
have no direct knowledge of the precise nature of the 
blast wave produced by the explosion of a large un- 
confined vapour cloud. The reasons are obvious 
enough. Such explosions as have occurred by accident 
have, of course, been totally unexpected, and no 
monitoring equipment has ever recorded one of these 
events. On the other hand, the number of variables 
involved in a large unconfined vapour cloud explosion 
as outlined in the preceding paragraphs is such, and 

*See Glossary 



the cost of carrying out even one experiment so large, 
that it has not yet been found possible to outline an 
agreed experimental programme, far less to carry one 
out. We hope that this state of affairs may be 
ameliorated in the near future, but it will be many 
years before we can hope to have satisfactory answers 
to any but the easiest of the questions which can be 
posed. In the meantime, there is (from defence and 
home security sources) considerable knowledge of the 
behaviour of various types of structures subjected to 
known degrees of blast from high explosives, notably 
TNT. There is some knowledge of the behaviour of 
some similar types of structures accidentally subjected 
to unknown degrees of blast from estimated amounts 
of vapour mixed to estimated degrees with air. It is 
therefore possible to make some attempt to deduce 
the quantity of TNT which would have given this 
amount of damage at a considerable distance from the 
position at which it has been assumed to be 
detonated. When this quantity of TNT is related to our 
estimates of the amount of vapour in the cloud the 
factor of 0.1 to 1 previously discussed emerges (para 
125) and we have given our reasons for accepting a 
factor of 0.3 as a sensible estimate when discussing 
the precautions and protection which should be pro- 
vided at a considerable distance from the likely 
epicentre of any possible vapour cloud. In the con- 
sideration of the precautions and protection which 
should be provided at a lesser distance, the'equivalent 
TNT' model breaks down completely, and we have 
suggested from the scanty evidence available that the 
maximum side-on overpressure due to the explosion 
of a vapour cloud should be taken as 1 bar at the 
middle, falling to 0.7 bar at the boundary, and the 
corresponding 'duration' as 30 milliseconds. We have 
no knowledge about the effective centre of such an 
explosion. When these estimates are collated, an in- 
teresting and useful coincidence becomes evident, 
thus: assume that V tonnes of hydrocarbon vapour 
mix with air to give a mean stoichiometric mixture*. 
If the cloud is of a form postulated in para 120 it will 
have a radius of 30\J r V~metres. Its equivalent mass 
(para 125) will be 0.3V tonnes of TNT. Now the 
'scaled distance' at which TNT causes an overpressure 
of 0.7 bar (Fig 5) can be read off as 40, so the actual 
distance at which the pressure is 0.7 bar will be 
V metres. 



40>y 0.3V or 27^ V metres. Thus the cloud radius and 
the radius at which the overpressure might be ex- 
pected to fall to 0.7 bar are sensibly identical and it 
can be assumed that the charge of TNT might be 
detonated at any point within a small circle, of radius 
R = 3^"V~ metres, from the centre of the hypothetical 
hemispheroidal cloud, which gives a semi-rational 
overpressure distribution, varying from 1 bar to 0.7 
bar within the cloud, and outside it decaying in accord- 
ance with the well-established curve in Fig 5. 
The result is illustrated in the lower of the dotted 
curves in that figure. Alternatively, if it be considered 
preferable to assume that the effective centre of the 



*See Glossary 
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Fig 4 Simplified plan of Flixborough Works of NYPRO (UK) LTD 



explosion coincides with the centre of the cloud, and 
if it be still desired to equate the distance at which the 
pressure equals 0.7 bar to the cloud radius, a slight 
modification can be made in the factor 0.3 accepted 
earlier as a sensible guess between 0.1 and 1, for the 
TNT equivalent. Calling this factor k, a simple rela- 
tionship 

R = 30\TV = 40/W whence k = (3/4)' or 0.42 
emerges. As stated earlier, such a change makes little 
difference in the overpressure/distance relationship: 
the result is illustrated in the upper of the dotted 
curves in Fig 5. 

134 It should surely be clear that we have no 
thought of suggesting that either model is 'correct', 
but either offers an overpressure/distance curve 
without discontinuities upon which the rational design 
of buildings within the whole area may be based until 
more accurate data are available. 

135 A most valuable paper by Sadee, Samuels and 
O'Brien' 4 has been published, in which the 
characteristics of the Flixborough explosion are ex- 
amined. In particular, the authors estimate that a 
total of 40 tonnes of cyclohexane escaped (of which 
30 might have formed a doud) an d from a detailed 
examination of the damage caused they estimate the 



overpressure at distances varying from 98 to 2745 
metres from the cloud centre. They conclude that this 
damage corresponds to that which would be expected 
from the detonation of 16± 2 tonnes of TNT at a 
height of 45± 24 metrest Their overpressures, deduced 
from the damage, have been plotted in Fig 6 against 
the curve we have just suggested as reasonable. The 
cloud radius has been taken as 30y^40 or 102 m and 
the TNT equivalence factor as 0.42, with the effective 
centre at the cloud centre. It is true that some of the 
actual damage is slightly in excess of our estimate 
-after all, this could well have been an instance when 
due to unusually effective entrainment or some similar 
cause the factor was unusually high - but when con- 
sidering that the actual cloud 'radius' varied from 70 
to 175 metres in a totally unpredictable manner, it is 
encouraging to find that the crude estimate cor- 
responds so closely to actuality in this particular in- 
stance. 



tWe understand from the authors that this height is not to be taken 
literally but that it provides a convenient mathematical model which 
gives the best fit for the observed evidence. 



37 



1-0 
0-9 
0-8 
0-7 
0-6 






0-1 
•09 
•08 
•07 
•06 



Basic curve for TNT 




Overpressure causing serious but not fatal injuries 



-^- Assumed upper bound for overpressure in cloud 



- Category A damage* 

-Assumed overpressure at cloud edge 



Overpressure causing category B* 



Damage at radius 56VW tonne metres 



Category Q-, damage* 



03 ■ O 
> 



-20 




-10 



-5 



Window glass 

breakage 

90% 



If 1 tonne vapour = 0-42 
tonne TNT exploded at R 



If 1 tonne vapour 

= 0-3 tonne TNT exploded 

at R = 3Vv metres 



f 50% 



Z 
m 



55 



-2 



- 1-0 



-0-5 



0-2 



40 50 60 70 80 90 100 



300 400 500 600 7 8 9 1000 



"Scaled distance" = distance (metres) 

2/M tonnes TNT or equivalent 



* Damage categories as defined in chapter 6 
Fig 5 Graph of 'side-on' peak overpressure versus 'scaled distances' 



38 



1 Bar 

0-7 
0-6 
0-5 

0-4 
0-3 

0-2 



•a 



0-1 



0-02 



0-01 



Cloud boundary 



Category A damage 



Category B 



Solid lines: site survey 
Dotted lines: neighbourhood 



Category Cb 



Flixborough: 40-tonnescyclohexane leakage 




Cloud radius and 
overpressure estimated as 
outlined in paragraph 133 

(1 tonne vapour = 0.42 tonne TNT) 



Vertical (and one oblique) lines show ranges 
of overpressure at various distances 
estimated from damage caused 




Window glass 
breakage 



50% 



100 



1000 



4000 



Distance, metres 



Fig 6 Sadee data 



39 



6 Buildings in the area of an 
explosion hazard 



The overpressure experienced from an un- 
confined vapour cloud explosion will affect 
any personnel, plant or building in the whole 
area. The committee discusses which 
elements of management control can reason- 
ably be removed from the most hazardous 
areas and considers the function, design 
criteria and siting of control buildings. The 
effects of unconfined vapour explosions on 
control buildings at Flixborough and Beek 
and the problem of flying glass are critically 
examined. 



136 Two recent explosions have focused attention on 
the need to site and design buildings in the vicinity of 
major hazards in such a way as to escape destruction 
in the event of external explosion; in particular, at 
Flixborough in 1974, where not only the control 
building for the caprolactam complex but even the 
main office building suffered total collapse; and the 
much smaller one at Beek, in Holland, which caused 
severe damage to the control building. Both cases 
gave rise to loss of life which, though serious, could 
have been much greater. 

137 In this chapter we discuss which elements of 
managerial control can reasonably be removed from 
the most hazardous areas, and consider the siting and 
design of such buildings as from their nature and pur- 
pose cannot be so removed. In the preceding chapter 
we discussed the overpressure which may 'be ex- 
perienced at any distance from an unconfined vapour 
cloud explosion, and is therefore relevant to any per- 
sonnel, plant, or building in the whole area. Attention 
will be concentrated first on the very special problem 
of the control building (or room, or house). It is 
special in that although from the aspects we have been 
discussing an obvious partial answer to the question 
"How far should any building housing people be 
from a conceivable vapour cloud?" would be "As far 
as possible", such a simplistic attitude is not valid in 
relation to a control building. The further a control 
building is from the centre of the plant the greater 
become the technical, operational, and economic dif- 
ficulties of exercising effective control of the process 
and to site the building further away than it need be 
could result in reducing significantly the safety of the 
plant in day-to-day working, and therefore on balance 
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increase the total risk to which men and plant were 
subjected. This is why this particular problem requires 
more careful study. It makes sense to start by con- 
sidering the proper function of a control building. 

The function of a control building 

138 The normal function of a control building is to 
maintain conditions suitable for the functioning of the 
people and equipment it houses. It obviously does not 
follow that such a building will afford adequate pro- 
tection against the extreme changes in environment 
which occur in the event of a disaster. Indeed, it is 
not always recognised that the sense of security 
engendered by being behind walls may well be 
spurious, and that if an explosion occurs the in- 
habitants of existing control buildings may be at 
greater risk than people caught in the open at the 
same distance from the explosion. On the other hand, 
given adequate design, it should be possible to make a 
control building a much safer place than the open air. 

Separation of the various elements of 'control' 

139 It may be useful to consider with some care the 
various elements which are often included in the con- 
cept of 'control', in order to distinguish those which, 
as argued in para 137, really need to be near the cen- 
tre of operations from others subject to no such need. 
For instance, to take the extreme case, it seems ob- 
vious enough that overall management control of an 
enterprise, at the highest level, need not be on the site 
at all. Site management control normally would be, 
but the buildings housing it should surely be as 
remote as reasonably possible from the sources of ex- 
plosion or major fire and be adequately designed; yet 
at the explosions at Pernis, Flixborough, and Ant- 
werp, serious damage (indeed complete destruction in 
one case) was sustained by main office buildings. 

140 In hazardous situations every effort should be 
made to reduce, if not to eliminate, all but direct 
operational activities from buildings adjacent to the 
hazard. 

141 Closer to the point of production come the con- 
trol laboratory and instrumentation. 'On-line' analysis 
is a growing feature of process control and housing of 
the automatic analytical equipment close to the centre 
of production cannot reasonably be avoided. Where 
'off-line' analysis is carried out by shift process 
operators its housing in a special part of the control 
building can probably be justified. Laboratory tests 



which demand skills, time, or attention beyond those 
which an operator can afford should be transferred to 
a laboratory more remote from the hazard area. 

142 Finally, however, there comes the necessity to 
operate that nerve centre or plexus at which, primar- 
ily, input signals from the process generate output 
signals to control the process and at which data con- 
cerning these signals are logged. The signals are in 
large measure electronic or pneumatic, and the 
associated transducer may be a human operator, an 
automatic servomechanism, a computer, or some 
combination of these, but also and importantly the in- 
put signals include sight, sound, and smell. The need 
to receive, interpret and act on these signals means 
that human beings must be on the spot, must visit the 
plant, and must report or act. 

143 It follows from all this that it is highly desirable 
to analyse very carefully the functions which really 
have to be performed in the control building proper 
and to eliminate provision for anything which is not 
essential. Separation of the accommodation for the 
various elements of control may indeed lead to some 
minor communication problems with a consequent 
small increase in running costs, but it will make poss- 
ible a considerable reduction of manning and equip- 
ment in the most vulnerable areas and so reduce cost 
by restricting high-specification building to housing 
these essential elements and no other. 

Criteria which determine the need for a strong control 
building 

144 Ideally, every control building on sites where un- 
confined vapour cloud explosions are possible should 
be designed to withstand such explosions. There will, 
however, be many cases where the considerable prob- 
lems arising from such a crude criterion would far ex- 
ceed the likely benefit; perhaps because of adequate 
separation, small inventory at risk, or the extreme 
unlikelihood of serious explosion effects. 

145 If adequate separation is possible, a conven- 
tional control building could be designed to give 
proper protection to the operators within it. In other 
cases, a decision will be needed as to whether a con- 
ventional, or a strongly designed, control building 
should be built, or even whether, in exceptional cases, 
existing control buildings should be strengthened. 
After extensive consultation with industry, we think it 
right that guidance should be given to those who 
make such decisions. 

146 We have considered the possibility of listing 
specific types of new installation where strong control 
buildings would be necessary, but we are not satisfied 
that such a list would encompass all those plants 
which clearly need one unless it also included a great 
number of comparatively innocuous installations. We 
have therefore adopted the following approach to the 
problem of deciding what size of incident should be 
considered when designing an adequately strong con- 
trol building. 



147 As regards pressure vessels themselves, provided 
that it has been shown that the appropriate degree of 
strength is present and maintained by correct design, 
fabrication, testing, and inspection, it may be ac- 
cepted that they will not fail; and under the same 
strict conditions the same acceptance may be extended 
to certain short, large-diameter, simple pipes. 

148 For all other parts of an installation, the criteria 
would be the rate at which flammable material could 
escape and the total amount which could escape; and 
the following assumptions would be normally man- 
datory: 

1 That there could be a failure of containment in 
the lines around each pressure vessel equivalent in 
area to the cross-section of the largest line. 

2 That the contents of the pressure vessel emerge 
totally, unless the rate of emission is such that 
emergency action can be taken to stop the emission 
before the vessel empties. For each pressure vessel, 
or group of vessels, the details of the emergency 
action which will cause the flow to stop must be 
specified. 

3 That vapour arising from liquid material which 
has been generated by adiabatic flash to 
atmospheric pressure will be accompanied by an 
equal mass of mist/aerosol, or the remaining 
inventory if that is a lesser quantity. 

If the flammable airborne emission so caused is 
greater than 15 tonnes and adequate separation is not 
possible a strong control building will be needed. 

149 Pressure storage facilities which are separate 
from the processing area can be treated less rigorously 
if it can be shown that the pipes leading to and from 
the storage vessel are well protected from external 
damage by traffic, cranes, and the like, and that an 
automatic flow-prevention valve close to the vessel 
will stop or adequately restrict the flow if the pipe 
beyond it is broken. With such safeguards, storage 
vessels remote from the process with a capacity of 
several hundred tonnes will not call for the provision 
of a strong control building. 

Emergency control 

150 Every hazardous site needs to have a room or 
suite of rooms which become the headquarters of the 
incident controller in the event of a disaster. Such 
room or rooms can be housed in the management 
control building but the overriding consideration is 
the need for emergency control to be at a location 
convenient to a main entrance to the site. We believe 
very forcibly that main emergency control must not be 
housed in a control building if this is sited in a haz- 
ardous area; and that the general considerations about 
siting and design which are discussed in this chapter 
apply with even greater force to emergency control 
buildings which must be of a construction capable of 
withstanding, without serious damage, any explosion 
which could occur on the site. 
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151 Discussion of the facilities which should be pro- 
vided at emergency control is outside the scope of this 
chapter but it might be noted, in passing, that an 
emergency control room need not be sterilised for 
other uses when not required for emergency purposes. 
It could be used, for example, as a conference 
room. 20 ' 21 

Siting of a control building 

152 For the operational reasons discussed above, it 
must be accepted that a control building may have to 
be so sited that, in the event of a vapour cloud explo- 
sion, it will be subjected to a considerable shock 
wave: an estimate of its probable magnitude has been 
outlined in paragraph 115. If calculations show that 
the probability that the building will be within the 
possible cloud is so remote as to be negligible, the 
shock wave can be regarded as a vertical wave moving 
horizontally towards it. Any wall of the building 
facing the shock will have to 'withstand' (as discussed 
below) the much higher reflected pressure, and the 
side walls and roof the travelling wave. Information is 
available 22,23 ' 24 as to the design methods which could 
be adopted, and it would not seem to be unduly ex- 
pensive or time-consuming to carry out a modest ex- 
perimental programme to check these methods. 

153 A more difficult situation would arise if it could 
not be shown that the control building would be out- 
side any probable cloud. If it were known that in a 
vapour cloud explosion a genuine epicentre (as op- 
posed to an epicentre postulated near the centre of the 
cloud for purposes of calculation) existed, and if the 
building could be shown to be outside a 45° cone 
under this epicentre, the preceding argument could be 
accepted as valid for the new situation, and a building 
designed to withstand a horizontally-travelling shock 
wave with peak overpressure of 1 bar and duration 30 
ms could be regarded as totally acceptable. A typical 
design basis for a reinforced structure recently pro- 
mulgated by a working party appointed by the 
Chemical Industries Association's Chemical Industry 
Safety and Health Council 24 to cope with the less 
stringent conditions of 0.7 bar with 20 ms duration 
has been critically and independently examined and 
the conclusion reached that provided certain 
reasonable further conditions are observed such a 
building would indeed 'withstand' the higher loading. 

154 The fact must however be faced that in the case 
of a very serious accident involving the escape of a 
large amount of flammable vapour the cloud may be 
so big that the control building cannot be sited to be 
certainly beyond its confines; indeed it may be en- 
gulfed within it. It seems clear that in what would ap- 
pear to be the worst case, that is, if the effective cen- 
tre of the explosion were to be directly overhead and 
a full downward overpressure of the magnitude sug- 
gested were to be exerted on the roof of a building 
designed to withstand only the horizontally-travelling 
shock wave it would collapse. It does not, however, 



appear to be unduly difficult to design a building to 
withstand the full pressures within the cloud if these 
pressures have been correctly estimated in the 
preceding chapter. According to advice received from 
HSE such a building could be constructed in reinforced 
concrete or could equally well be of the steel portal 
frame type, either of which could give the ductility 
necessary to accommodate large deflections within the 
plastic range. Summing up, it would seem that we can 
by the use of pragmatism and common sense justify a 
few general conclusions. 

In the first place, without indulging in the sort of 
hubris which preceded the 'Titanic' disaster, we can 
say that the sort of control buildings envisaged (see 
above, and para 157) if not impregnable would be 
many times stronger and more resistant than those 
commonly erected in the past. 

155 In the second place, a control building should if 
reasonably possible be sited to be outside the confines 
of any likely cloud. If excessive distance should be 
found to introduce worse risks of accident in everyday 
operation than those to be feared from the relatively 
remote possibility of a vapour cloud explosion, it still 
makes sense to site it as far as tolerable from the 
danger area, not only because this will reduce the 
overpressure it will have to withstand from a smaller 
explosion but also because in the case of a really 
major accident the probability that the building will 
be directly under the effective epicentre, assuming no 
cloud drift, will diminish the square of the distance 
from the point of escape, and the depth of the cloud 
cover which must be important in relation to the 
actual vertical overpressure produced, may reasonably 
be expected to fall off with distance. The danger of 
excessive vertical overpressure would therefore appear 
to vary inversely with roughly the cube of the distance 
from the effective centre. 

The meaning of the word 'withstand' 

156 From the point of view of the owners and 
operators of the installation, it is clearly highly 
desirable that the control building (along with all 
other plant, not to mention personnel, on the site) 
should emerge undamaged, or only trivially damaged, 
from any accident which occurs, and it should not be 
overlooked that a building which had been designed 
just to 'withstand' the worst accident calculated as 
reasonably possible might well emerge with little or no 
damage from a grave but lesser catastrophe. In these 
circumstances the savings which would result from 
what might be regarded as 'over-design' might well 
far outweigh the additional costs incurred. But that is 
not our concern here. We are concerned with the 
'worst possible' accident envisaged in Chapter 5 and 
in relation to it the word 'withstand' is used in a very 
special sense. The control building may finish up very 
heavily damaged, with walls cracked and leaning and 
roof sagging but, as long as those inside are alive and 
well, and enough of the equipment remains 
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serviceable to let other plant be shut down without 
allowing another disaster to follow, the building has 
in our sense 'withstood 1 the catastrophe. 

Design of a control building 

157 The detailed design of any building is, of 
course, wholly outside of the scope of this chapter 
but, in view of the size and type of the buildings 
which have in the past housed the control function on 
hazardous sites, a few general comments are con- 
sidered appropriate: paragraphs 139-143 argues that 
the control building of the future will be a relatively 
compact structure housing only the vital elements; 
paragraph 156 clearly implies that it will not be a 
multi-storey brick building with picture windows. In- 
deed, for economic reasons, it will almost certainly 
take the form of a single-storey building of either 
heavily-reinforced monolithic concrete or of heavy 
steel frame construction. Needless to say, the design 
will be based not on the ability of the structure to 
withstand the imposed stresses elastically, but on its 
ability to absorb, by plastic deformation, the shock 
energy transmitted to it. The possibility that it should 
be so built as to be able to slide slightly on its found- 
ations in the event of a major explosion has been 
considered but effectively discarded: such a movement 
would reduce the problem of providing a building of 
adequate strength but introduce difficulties of 'con- 
nection' which appear to be virtually insuperable. 
Windows, on balance, seem for the time being to be 
desirable, though on occasion they might be 
eliminated by the use of closed circuit television 
equipment; but they will be severely restricted in 
number and size, very firmly mounted, and, of 
course, designed to minimise the risk of injury from 
flying fragments of window material. Proprietary win- 
dows of adequate size are available which could with- 
stand the overpressures we have been discussing. No 
heavy equipment should be mounted in the roof, and 
no adjacent structure which could fall on the control 
building should be permitted. 

Existing installations 

158 We do not propose, for the time being, to 
recommend that existing control rooms should either 
be re-built to this standard, or even, in general, to be 
up-rated by reinforcement. There probably are, 
however a number of control rooms where the risk is 
much higher than is the general case, and we believe 
that the hazard surveys which we have proposed will 
help to identify those control rooms which should not 
be allowed to operate beyond a certain period (to be 
determined) without some reduction in risk to persons 
within them. When considering the technical ob- 
solescence of an installation, the design of the control 
building should be one of the more important factors 
to be taken into account. 

Other buildings in a hazardous area 

159 Although the control building is a special case, 

it is obvious enough from the disasters which have oc- 



curred in the past that other buildings over a very 
large area, and their occupants, can be put at serious 
risk by a major vapour cloud explosion. If the 
arguments in the preceding chapter, culminating in the 
curves shown in Fig 5 and substantiated by the Sadee 
data 14 illustrated in Fig 6, are accepted as valid, we 
have enough information about the whole region to 
guide designers and planners in their work. 

160 Summarising very briefly information which re- 
quired careful study in the original documents 
may be said that bomb damage up to and including 
the 1939/45 war has been classified with regard to its 
effect on 'dwelling houses' in a number of groups, of 
which the following are the most relevant. 



Damage 
classification 



Description 



A Almost complete demolition 

B So severe as to necessitate demolition 

Cb House unhabitable but not totally irreparable 

Glass damage Expressed as percentage of windows broken 



161 The overpressures arising from the explosion of 
TNT which would be expected to give rise to each of 
these types of damage have been indicated in Fig 5. 
There seems to be no real reason to doubt that com- 
parable overpressures arising from the explosion of a 
vapour cloud would cause similar results. 

162 It must however be repeated that these 
classifications were determined from the damage in- 
flicted on 'dwelling houses' and their windows: in- 
dustrial buildings on the site will normally be of quite 
different construction and their safety should be con- 
sidered from first principles in the light of the over- 
pressures they might have to withstand. Needless to 
say, we recommend that new buildings be designed on 
a conservative basis to withstand pressures not less 
than those indicated by the dotted curves in Fig 5. 

The problem of flying glass 

163 When a large explosion occurs, be it because of 
enemy action or of industrial accident, windows are 
invariably broken over a very large area, and flying 
glass can cause serious injuries. Considerable public 
anxiety exists, and the dangers cannot be ignored. We 
have therefore given serious attention to this problem. 

164 Obviously, a rational approach would be to con- 
sider in detail the fatalities and lesser casualties caused 
by previous vapour cloud explosions, or by com- 
parable explosions of TNT, but the facts seem not 
have been recorded in sufficient detail to be very 
helpful. If we consider the most recent cases, we find 
that at Beek a total of 2508 cases of damage outside 
the factory was reported, consisting almost entirely of 
broken window panes: one woman was injured by 
glass. At Flixborough a total of 6539 windows outside 
the factory were broken in an area in which there 
were 4153 houses together with shops and factories. 
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Six people outside the factory boundary were injured 
with sufficient severity to cause them to be detained in 
hospital. A total of forty eight people were treated in 
hospital, of whom only six were injured at their 
homes. Clearly the information available is quite in- 
sufficient, but it would seem that the danger may be 
exaggerated in the public mind. Though it is positively 
known that some of those injured were injured by fly- 
ing glass, it is not known how many. The figures of 
six and forty eight represent therefore the upper 
bounds of glass injuries but the true numbers are 
believed to be much less. 

165 An alternative approach would be to carry out 
experimental work on the size and velocity of glass 
fragments from windows broken in this way. Exactly 
appropriate work does not seem to have been under- 
taken in this country, but what at first sight seems to 
be very relevant work has been carried out under the 
auspices of the Gas Council, and their reports are of 
course much more scientifically detailed than are 
reports of damage from war-time accidental 
explosions. If when we take as reasonably typical 
of 'dwelling houses' a window in 24 oz glass 1 square 
metre in area subjected to pressure caused by an 
explosion inside a room, Harris et al 27 find that 
the peak pressure to break it varies from about 0.03 
to 0.05 bar. Smaller windows, or windows made from 
thicker or better glass, withstand considerably higher 
pressures. Figure 5 shows that an overpressure of 
0.038 bar would be expected to break 90% of dwell- 
ing house windows. We have to make allowances for 
too many different factors such as the reflected 
pressure, the age of the glass, the quality of the fixing 
and so on, to say more than that we are clearly 
discussing the same order of magnitude. The paper 
quoted records in many cases the fragment velocity 
from the broken windows. It is true that the lowest 
pressure used in these experiments seem to have been 
0.04 bar, but the fragment velocity varied astonish- 
ingly little, and was of the order of 40 mis or 90 mph, 
which must be regarded as quite intolerable. A 
moment's thought, however, shows that these ex- 
periments are likely to exaggerate very greatly the 
dangers we have to consider. In the case of these in- 
ternal confined explosions, the pressure builds up 
relatively slowly (ie a few milliseconds) to a maximum 
value at or near which the window presumably 
breaks. At the moment of breaking, therefore, every 
element of the glass is being subjected to the peak 
value of the pressure, which will certainly not fall to 
zero instantaneously. Moreover, the gases escaping 
past the fragments must exert on them a considerable 
drag force. An elementary calculation suffices to show 
that if the pressure remains high for even a small frac 
tion of a second, such fragment velocities are in- 
evitable. In our case the exact opposite is true. 

166 To take first the case of dwelling houses in the 
far field, it is a matter of common knowledge that 
broken windows have frequently simply fallen out- 



wards during the negative phase of the shock wave, 
no doubt at least in part because the inward fixing is 
normally much the stronger. Moving inwards towards 
the explosion, it seems rational to suggest that when 
we reach a region in which 50% of the windows break 
due to the applied positive impulse, and consequently 
50% of the windows do not break but recover 
elastically without even cracking, the average frag- 
ment velocity will be very low indeed, since at the in- 
stant of breakage the pressure must have fallen almost 
to zero. This (see Fig 5) would occur at a peak over- 
pressure of about 0.016 bar. 

167 Fortunately there has been some important work 
carried out in the USA which has been brought to our 
attention by Mr W G High, a member of the 
Chemical Industries Association working party. Ex- 
perimental windows nominally %" (3mm) and 
'/4"(6mm) thick were mounted at various distances 
from large masses of TNT, so that overpressures about 
0.3, 0.5, and 0.6 lb/in 2 (0.02, 0.035 and 0.04 bar) 
with a duration of 250 milliseconds were applied to 
them, and the relationship between fragment mass 
and velocity determined. In separate experiments the 
probabilities that such fragments would penetrate bare 
skin, or clothed skin, or 1 cm of soft tissue, were 
determined. Only a single fragment (out of 90) from 
the thicker windows broken at the highest pressure 
was found to have a 10% probability of penetrating 

1 cm: none from the thinner windows, where the 
mean fragment mass was much less. No other frag- 
ment had even a 1 % probability of penetrating 1 cm. 
Whether, in view of the improbability of the 
catastrophic accident we are discussing and the im- 
probability of a fragment of glass broken at these 
pressures doing any damage, a much higher over- 
pressure should be regarded as permissible must for 
the moment remain an open question: for the time be- 
ing there would seem to be ample justification for 
regarding the risk from an overpressure of 0.04 bar as 
tolerable. 

168 On those sites to which the criteria in paragraph 
144 apply, it may well be that buildings other than the 
control building can be in danger of being subjected 
to higher overpressures than 0.04 bar. It may be ex- 
tremely difficult even to plan a new site without 
giving rise to such a situation. In these cases it is 
possible to give greatly improved protection to people 
inside the buildings by the application to the windows 
of a shatter-resistant protective film. Again, although 
the results would require to be checked to allow for 
the very different conditions, Harris et al 27 show 

that the film results in a dramatic reduction in frag- 
ment (or whole pane) velocity. Moreover, Home 
Office trials 28 , in some respects resembling much more 
closely the conditions we have to cope with, in that 
explosive impulses giving peak overpressures varying 
from 0.25 to 1.7 bar but with a duration of only 1 ms, 
were applied to various test panes and gave equally 
dramatic results. 
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Table F Case histories of effects of unconfined vapour explosions on control buildings 



Item 


Flixborough 


Beek 


Date and time 


1/6/74 16.53hrs 


7/11/75 9.50 hrs 


Agent responsible 


Cyclohexane 


Propylene 


Quantity released 


40 tonnes 14 


5.5 tonnes 


Time taken for release 


45 seconds 29 


120 seconds 


Approximate mean radius of cloud 


102 metres 14 kidney shaped 


50 metres Irregular shape 


Radius of cloud (as calculated from 
formula in Chapter 5) 


102-105 metres 


50 metres 


TNT equivalent of blast 


16 ± 2 tonnes 14 


2.5 tonnes 


Fatalities 


28 (All inside factory) 


14 (All inside factory) 


Injuries 


36 inside factory 53 outside factory 


104 inside factory 3 outside factory 


Description of control building 


2 storeys plus mezzanine, concrete frame, 
brick panels 30 


2 storeys plus mezzanine, concrete frame, 
concrete panels 


Approximate dimensions 

i 


Height (max) 10 metres 
Width (max) 13 metres 
Length (max) 43 metres 30 


Height 11.5 metres 
Width 17.0 metres 
Length 35.0 metres 


Damage sustained 


Total collapse with pipe bridge on top 


Severe blast and fire damage without collapse 


Fate of process records 


Total destruction 


Almost total destruction 


Approximate distance of building from 
presumed epicentre 


90 metres 


40 metres 



Scaled distance* of building from presumed 
epicentre based on Fig 6 

Deduced overpressure at control building 



26 (Based on 40 tonnes vapour) 
0.7 bar (from TNT model) 



22 (Based on 5.5 tonnes vapour) 

0.2 - 0.3 bar (general, from damage) 
1.0 bar (local, from damage) 



* See Glossary 

Figures are taken from official reports except 



where indicated by reference or otherwise qualified. 
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7 Minimisation of exposure to 
hazards of people on site 



Full consideration of the safety of personnel 
who are employed at, or may be allowed 
access to, the site must from the earliest 
planning and design stages of an installation 
run parallel with the consideration of plant 
and buildings. The committee establishes 
categories of people and of hazard areas in 
relation to risk and discusses the siting and 
construction of buildings within the site 
boundaries and the appropriate limitations of 
access. The essential features of a formalised 
arrangement of procedures and permits in 
designated areas is set out. 



169 Although major hazard installations may be 
designed, constructed, maintained and operated to the 
highest standards, the remanent possibility of an inci- 
dent which could lead to a serious explosion, toxic 
release, or cataclysmic fire demands that attention be 
given to personnel who are employed at, or may be 
allowed access to, the site. This is important, not only 
to minimise the risk to those persons, but also because 
some of them will be those needed to take action to 
limit and control the immediate effects of an incident. 
Full consideration of the safety of these people must, 
from the earliest planning and design stages, run 
parallel with the consideration of plant and buildings, 
and in particular, critieria should be set for the limit- 
ation of access to those areas which are acknowledged 
to be the most dangerous and which we will refer to 
as 'designated areas'. Although the numbers allowed 
in such areas should clearly be kept low, because 
those involved will be exposed not only to major 
catastrophes but also to minor incidents which have 
only local effects, it should be recognised that even in 
these designated areas there is an optimum number, 
commensurate with the safe and efficient operation of 
the plant, and that this number will vary from time to 
time with the operational conditions. 

170 It must be accepted at the outset that absolute 
safety cannot be attained for those who work in a 
hazardous environment, but it is obviously desirable 
to reduce the risk for each individual to a minimum, 
and in pursuing this objective it is helpful to group 
the people concerned into some four categories. First- 
ly, there are those who have to be permanently 



located in a designated area, e.g. plant operators; 
secondly, those who when they do visit such an area, 
spend much of the working day there but only as part 
of their year's work, e.g. maintenance staff; thirdly, 
those who have reason to visit the area fairly often 
for short periods, e.g. technical staff, and lastly, those 
who need to spend relatively little or no time in the 
area, e.g. office staff. There must also be a system 
concerned with the dividing up of the whole works 
site on a common sense basis into areas corresponding 
to the degree of hazard. These will be the designated 
areas which, in the context of this chapter, will be 
those areas, in which at the time of a specified 
disaster anyone in the open would be liable to serious 
injury or death. At the other end of the scale there 
should be areas in which there would be no injuries of 
any consequence to anyone in the open. In between 
are those areas where there may be injuries or even a 
slight possibility of death to those in the open depen- 
ding on the particular circumstances of the incident. 

171 We think that the establishment of categories of 
people and areas should be sufficient to guide a com- 
petent and safety conscious management into certain 
lines of thinking. Naturally these considerations must 
be weighed with the other technical, commercial and 
employee considerations in order to achieve a proper 
view of action to be taken, but the following 
paragraphs concentrate exclusively on safety matters 
and develop various points in detail. 

172 It is self-evident that the number of people per- 
manently located within a designated area should be 
the minimum necessary for the proper operation of 
the area itself. This must take account not only of 
normal perturbations but also the emergency man- 
power requirements as laid down in the emergency 
operating procedures. The numbers are not necessarily 
the same on day work as shift work as the latter is, to 
some extent, dependent on the activities of certain day 
employees, e.g. the operating day supervisor, per- 
manently allocated day engineering craft workers and 
day cleaning arrangements, all operations which can 
require the full time presence of certain employees. 

173 Thus there will be a number of people whose 
presence in the vicinity of a designated area is ab- 
solutely necessary and it may be self-defeating to 
deem that some of these employees should not be per- 
manently housed within the area when in practice it is 
essential that they spend nearly all their working time 
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there. However, the relevant word is 'essential' and 
should not be used when 'convenient' is more ap- 
propriate. On the other hand there may be staff such 
as technologists and other professionals, plant ad- 
ministrative assistants, operator training officers, 
maintenance supervisors and schedule planners, who 
are required to be in the designated area for only part 
of their time. Such people need not, and should not, 
be housed in the area and their access there should be 
controlled. Therefore it is our view that even if the 
buildings in which people are located are of a blast 
resistant character, as outlined in Chapter 6, no-one 
should be permanently housed in, or indeed have ac- 
cess to, a designated area unless it can be clearly 
demonstrated that there is a good reason for that per- 
son to be there. 

174 It is obvious that the maximum number of 
people should be permanently located in situations 
where they should be subject to minimum harm in the 
event of a disaster. The kind of people who fall into 
this category of location are those who have virtually 
no reason ever to visit a designated area (certain ad- 
ministrative staff) and those who have reason to visit 
periodically such an area for short times (technol- 
olgists, draughtsmen, materials delivery staff, etc). 

175 It is customary and normally administratively 
convenient to have an office block at the site which as 
a minimum houses the general management and sup- 
port services such as finance and personnel depart- 
ments. In some circumstances it may also house 
several other functions such as some of the technical 
support services, training departments, materials ad- 
ministration, laboratory, catering arrangements. 

176 The design of such buildings is normally related 
to conventional office standards rather than to explo- 
sion resistance or prevention of ingress of toxic gases. 
Clearly if it is built far enough away from potential 
explosions or gas escapes, there is no need to depart 
from conventional office standards and equally clearly 
from a major hazard point of view the higher the pro- 
portion of the staff who are located there, the better. 
However, distance is not the only criterion, and it 
may not be possible to locate the office at a far 
enough distance, but if the design is suitable to offset 
the effect of building closer to a designated area there 
is no reason why this philosophy should not be ac- 
ceptable. 

177 There is no definitive answer as to how much 
risk someone located in the site office can be expected 
to run. While anyone in a designated area may be 
seriously at risk in the event of a serious incident it is 
doubtful if anyone in the office block considers that 
this should be a serious possibility. 

178 It is unrealistic to suppose that site office block 
employees can be insulated from the hazards of the 
business so that they run no greater risk than those 
employed in a conventional office remote from the 
site. In a major incident, the possibility of some in- 



jury could be expected, although it is unreasonable to 
suggest that people in or near those buildings would 
be liable to death or serious injury through building 
collapse or severe glass fragmentation. Accordingly, 
people working in such offices should be housed in a 
building of design and location which would give 
them a level of protection that does not put them 
seriously at risk. 

179 From the point of view of permanent location 
there remains a fairly large section of the workforce 
who are excluded from the designated areas, whom it 
is impractical to locate in a relatively remote side office 
block. These are employees such as those in the 
engineering workshops and associated materials 
stores, technical staff who work out of an office but 
who need to be in frequent contact with the plant 
areas. It is in the case of these kinds of employees 
that there is the biggest conflict between location for 
operational efficiency and location for safety in the 
event of an explosion or toxic release. It is our view 
that at worst their work base should be so located and 
protected that they would not expect to be seriously 
hurt. While this problem has similarities with which 
we dealt in the previous chapter, it is not the same 
problem and we believe it requires further study. 

180 There are times when an operator recognises a 
period of increased hazard, as for example during 
plant start-up. On some plants it is essential to mon- 
itor additional functions during this period if the 
operation is to be carried out safely, and this means 
that there must be additional personnel in the hazard 
area. Nevertheless, because it is a period of increased 
hazard the rules governing admittance to the area 
must be tightened to exclude rigidly those people 
whose presence is not essential. In this way, during 
periods of increased hazard, the number of people 
brought specially into the area may often be exceeded 
by the number who may be temporarily excluded. 

181 Similarly, circumstances arise in which there is 
no increase in the hazard from the plant but there is a 
need to bring into the vicinity of a hazard, substantial 
numbers of extra people above the normal operating 
complement. This may arise for example when install- 
ing new equipment in a designated area. Alternatively, 
a new plant may be destined for construction on an 
immediately adjacent vacant plot. Either of these 
situations would be accompanied by extra safeguard- 
ing to avoid interaction between the operating plant in 
a designated area and the new constructon. This 
safeguarding almost always involves additional con- 
trols on work procedures, permits and limitations of 
access to operating areas. Frequently it also involves 
physical barriers and the phasing of activities to 
minimise the possibility of an incident. However there 
are also times when the building of a new plant may 
be seen as quite inconsistent with continued normal 
operation of plant in a designated area which may 
therefore involve the temporary de-rating of the plant. 
In extreme cases this could even extend to complete 
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shutdown for a substantial period of time. 

182 It follows that the movement of people and 
equipment towards or into certain areas and the carry- 
ing out of associated activities must be covered by 
formal procedures such as permits to work. 

183 There should be no conflict between safety and 
getting a job done but it is futile to expect that pro- 
cedures and permit systems will work consistently and 
effectively unless they are rational, formalised, 
rigorously implemented and properly audited and the 
reasons for them clearly understood. 

184 The detailed mechanics of the procedures and 
permits can only be determined within the overall 
organisational arrangements and practices of the com- 
pany concerned but there are several features which 
we regard as essential: 

(a) There must be an organisational mechanism for 
considering and determining how many extra 
people there can be in a designated area in defined 
circumstances. 

(b) There must be a written permit arrangement 
before equipment can be brought into a des- 
ignated area and before anyone can work on 
equipment in the area. This permit arrangement 
must cover as a minimum the nature of the job, 
who is doing it, the time the permit is valid, the 
precautions to be taken with special reference to 



gas testing, hot work, proximity of people. 

(c) There must be a procedural arrangement for 
knowing who is working in a designated area at 
any point in time. 

(d) There must be a written procedural arrangement 
which clarifies the levels of authority for technical 
approval of the work to be undertaken, and the 
organisational arrangements for advising, consult- 
ing, recording and auditing of the work to ensure 
the full involvement and commitment of all staff. 

The final link in the chain, having determined that as 
few people as possible are exposed to a potentially 
serious incident is the emergency arrangement for 
dealing with an incident when danger is imminent and 
people are exposed. 

185 This requires a formalised set of emergency pro- 
cedures particularly the warning and evacuation ar- 
rangements for those in a designated area. To some 
extent these are dependent on the entry arrangements 
particularly if the designated area has its own 
perimeter fence (not to be confused with the site 
perimeter fence). 

186 If one of the principal concerns is the release of 
toxic materials then clearly one of the principal ways 
of limiting exposure from a post-incident point of 
view is rapid evacuation of these not involved in the 
operations of the plant into an area unlikely to be 
enveloped in the toxic material. 
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8 Research 



In recognition of the important role attached 
to research in assessing the factors which 
contribute to the realisation of a major 
hazard, the committee set up a fifth working 
group to study the subject. This chapter 
outlines their deliberations. The first task has 
been to evaluate the existing information 
available in the major hazard field in order 
that areas where further work is required can 
be identified. Particular attention has been 
paid to the problem of the dispersion of 
heavy gases and as a result of a recommen- 
dation made by the committee a series of 
trials has been completed. The results are 
discussed. The committee encourages increas- 
ing collaboration at international, govern- 
mental and industrial level. 

187 It has become apparent to us that a considerable 
amount of theoretical and experimental work on 
various aspects of major hazards has been, and is be- 
ing, carried out throughout the world. Nevertheless, 
there appears to be little co-ordination of the various 
programmes and there are many areas where there is 
considerable ignorance of the events which may arise 
following a failure in a plant handling hazardous 
materials. In particular we have felt it necessary to 
direct much of our attention towards the consider- 
ation of the behaviour of clouds of various substances 
in two broad categories; first those caused by the 
release into the atmosphere of a large quantity of 
flammable vapour in air which could burn or explode 
with results disastrous to persons or plant, and, 
secondly, those caused by the release of toxic gases in 
sufficient quantity to remain lethal at considerable 
distances from the point of escape. 

188 We believe that research has an important role 
to play in assessing the factors which contribute to the 
realisation of the potential for a major calamity. In 
this respect, and in addition to the need for greater 
understanding of cloud behaviour, we regard methods 
for ensuring the integrity of the containment system 
and detection of leakage as important aspects where 
new knowledge and techniques are required. We also 
consider that there is much to be learned from a study 
of incidents and of near misses, and we believe that 
thought should be given to how experience can be 



pooled and disseminated to the benefit of all concerned 

189 Thus in order that we may be properly advised 
on such matters, the fifth working group is closely 
collaborating with the other groups and with the Ex- 
ecutive's own research organisation. The group is ac- 
tively pursuing its main objectives which are firstly to 
indicate aspects relevant to the study, assessment and 
evaluation of major hazards which have been, or 
should be, subject to research; secondly to encourage 
research work in areas where there is thought to be a 
special need, and thirdly to facilitate the interchange 
of information between interested parties, both 
nationally and internationally. 

190 The group agreed that its principal task must be 
an examination of the present state of information 
available in the major hazards area, including a 
survey of the research work. Their present aim is to 
identify areas where further work is required and 
make recommendations on how this should be 
sponsored and monitored. 

191 It is immediately obvious that in the study of 
major hazards a multitude of disciplines interact and 

a full appreciation of the problems can be gained only 
by using highly specialised information and theory 
from several areas. Furthermore, because of the inter- 
disciplinary nature of the problems, the relevant 
published material is widely dispersed in the literature 
with the result that it is necessary to seek material 
published in apparently unrelated contexts. 

192 Notwithstanding these difficulties, which are 
common to the analysis of any complex problem, it is 
necessary to attempt to divide and categorise various 
aspects of the subject. For instance, the events leading 
up to an incident involving a vapour cloud may be 
considered in three separate stages, namely, release, 
dispersion and subsequent effects. Releases with which 
we are concerned will normally arise due to operator 
errors or following the fracture or failure of an item 
of plant and will involve the emission of large quan- 
tities of gas or vapour, possibly with associated liquid. 
The rate of emission will depend on the pressure and 
physical state of the material, upon the position, size 
and shape of the opening, and on those factors in the 
construction and layout of the plant which affect the 
flow of material towards the opening. Whereas there 
is plenty of information and adequate theory relating 
to the discharge of gases and vapours through orifices 
of simple shapes, the situation is completely different 
if the escaping material is a multiphase mixture and if 
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the geometry of the system is complex. Subsequent 
dispersion will be affected by such factors as the 
speed and direction of the discharge and the energy 
available to expel the material, by its density relative 
to that of atmospheric air, by atmospheric conditions 
and by topography — both the location of obstruc- 
tions in the vicinity of the discharge and the nature of 
the surrounding landscape. The consequences of the 
subsequent fire, explosion or toxic effects will again 
depend upon many factors, including the degree of 
confinement, the location and nature of an ignition 
source, the toxicity of the substance and the pop- 
ulation distribution. It should be noted that for a 
flammable material one is interested in concentrations 
measured in parts per hundred, whereas for toxic 
materials it is necessary to consider concentrations in 
parts per million. 

193 Extensive information is available from 
meteorological studies on the dispersion of gases of 
approximately the same density as air, but much less 
is known of the behaviour of gases of lower or higher 
density. The most important low density gas which is 
handled in large quantity is natural gas (mainly 
methane), which upon escape is likely to disperse 
rapidly because of its buoyancy at ambient 
temperatures. High density gases, such as chlorine, 
propane, butane, and refrigerated or low temperature 
gas, however, may travel for considerable distances 
close to the ground and even when they have become 
diluted to such an extent that they are only about one 
per cent denser than the surrounding atmosphere, 
their dispersion characteristics may be significantly 
different from those of neutrally buoyant gases. It 
was for this reason that we recommended at an early 
stage that research be commissioned on the dispersion 
of heavy gases. In response to and following the 
publication of the first report, the Health and Safety 
Executive asked the Chemical Defence Establishment 
(CDE) to undertake a series of trials in which dense 
mixtures of vapour and air were to be released and 
their spread across the ground monitored. This pro- 
gramme of work has now been completed and the 
results will be published in the near future. A brief ac- 
count of the work and of the preliminary conclusions 
reached, follows. 

194 The objective of the trials was to release a series 
of tracer gases with a range of initial cloud densities, 
under various meteorological conditions, to obtain 
data on the dimensions and rate of movement of the 
cloud and on concentrations at different stages of its 
spread; these data were then to be analysed in terms 
of existing theoretical models or of any extensions to 
these theories which might be developed during the 
course of the work. 

195 In practice a wide variety of conditions for in- 
itial release could occur. For example, the vapour 
might be generated from a pressurised liquid at a 
temperature above its boiling point at atmospheric 
pressure, or from a refrigerated liquid stored at its 
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boiling point at atmospheric pressure. The vapour 
might be released as a jet of high momentum. In the 
field trials no attempt was made to simulate any of 
these particular source conditions. Instead the source 
was designed to release a preformed mixture of con- 
trolled initial density with zero initial momentum so 
as to examine the combined effects of gravity and of 
atmospheric dispersion. 

196 In all the trials 40m 3 of dense vapour/air mix- 
ture was released from a collapsible-sided tent whose 
roof was held in position by vertical supports. The 
effect of the initial density of the cloud was studied 
by using a vapour of density 4.2 relative to air, mixed 
with air in various proportions. Shortly before release, 
orange coloured smoke was added to the dense mix- 
ture which was vigorously stirred and then left a few 
seconds to become quiescent. On operation of the 
release mechanism the tent collapsed to the ground in 
less than one second, leaving the smoke coloured mix- 
ture to disperse under the influence of gravitational 
forces and the wind. 

197 Five trial sites of different slope and ground 
roughness were used during the series and in each case 
the trial site was marked out with surveying poles to 
give horizontal and vertical distance scales. The be- 
haviour and progress of the cloud were monitored by 
using cine cameras arranged perpendicular to the main 
wind direction at ground level and overhead. Up to 
ten continuous vapour concentration monitors and up 
to one hundred and twenty dosage samplers were 
located downwind of the source. Standard meteor- 
ological measurements were taken during each trial. 

198 In total forty trials were carried out, covering 
the following ranges of independent variables: 

Initial density of mixture (relative to air) 1 .0 - 4.2 

Wind speed m/s 0.5 - 5.9 

Pasquill atmospheric stability categories B-G 

Ground roughness (from atmospheric 
velocity profile measurements) mm 2 - 150 

Slope Level rising 

to 1 in 14 in 
the direct- 
ion of the 
wind 

For each trial, provided that all the instrument- 
ation functioned satisfactorily, data were obtained of 
height, length and width of the cloud and of its move- 
ment across the trial site and of vapour concentration 
and dosage. Because of various instrumentation dif- 
ficulties and such factors as late shifts in wind direc- 
tion, a complete set of data was not obtained for each 
trial. 

199 The report, which is in course of preparation for 
publication by the Health and Safety Executive, will 
give a qualitative description of the work and an 
analysis of the data; a film illustrating various 
features of dense vapour dispersion is being produced. 



From a preliminary examination of the results it is 
seen that the influence of density on the dispersion 
process is considerable, particularly at low wind 
speeds, through the ground-hugging behaviour of 
dense clouds, their persistence in ground hollows and 
amongst long vegetation and in the greater degree of 
cross-wind spread compared with that for gas of 
neutral buoyancy. It seems likely, therefore, that a 
dense gas may be potentially more hazardous than a 
neutrally buoyant gas because dangerous concentra- 
tions can persist for a longer time. 

200 The results are being interpreted in terms of a 
model in which it is assumed that gravity-dominated 
dispersion in the early stages gives way to turbulence- 
dominated effects later in the process. It is believed 
that the model may represent an over- simplification 
and that the transitional region is at present inad- 
equately described. A more detailed modelling of the 
trial data is therefore being encouraged by HSE. As 
part of this study the trial data are being used in an 
international collaborative exercise to examine the 
validity of a number of existing theoretical models of 
dense vapour dispersion and the value of the data for 
this purpose has been stressed by a number of 
organisations. 

201 The completed series of trials represents a useful 
step forward in obtaining a better understanding of 
dense vapour dispersion behaviour. Nevertheless, the 
quantity of dense mixture released, about 150 kg, is 
small relative to the quantity which may well be 
released in an industrial accident where, as pointed 
out in Chapter 1, many tonnes of hazardous vapours 
have been released in the past. For this reason it is 
considered desirable that there should be some valida- 
tion of predictive models of dense vapour dispersion 
for larger sizes of initial release, and we are glad to 
learn that the Health and Safety Executive is in- 
vestigating with the Chemical Defence Establishment, 
Porton, a feasibility study to examine the instrumen- 
tation and logistic requirements of larger scale trials. 
As part of this exercise, the Health and Safety Ex- 
ecutive is engaged in technical discussions with other 
interested organisations to secure the maximum 
benefit from any trials which might be commissioned. 
Industrial contributions may be in the form of 
knowledge, money, materials, facilities and manpower 
and we can only encourage the development of such 
collaboration. 

202 We are also pleased to note that, besides the 
particular involvement in the work on dispersion of 
heavy vapours, the Health and Safety Executive's own 
research establishments are committed to research 
programmes which are relevant to the committee's 
work, and in addition are holding discussions with in- 
dustry on the possibilities of collaborative work. So 
far two particular problems have been identified for 
joint work and these relate to dispersion following a 
release of liquid ammonia and of chlorine respect- 
ively. 



203 It is our view that in the major hazards field the 
collaboration in the planning of experiments and the 
dissemination of information is appropriate at all 
levels. Thus we are pleased to note that at govern- 
mental level collaboration is taking place through the 
Organisation for Economic Co-operation and 
Development, which has set up the International 
Group for Unstable Substances. While this group is 
mainly concerned with problems connected with the 
manufacture, storage and use of materials with 
unstable properties, including explosives, it has set up 
a working group to study the effects of vapour cloud 
explosions. The working group exists principally for 
the exchange of information on research activities car- 
ried out or sponsored by government laboratories. We 
are kept informed of their deliberations through the 
participation of HSE at the meetings which occur at 
approximately yearly intervals. 

204 At the industrial level we are aware of the in- 
volvement of the Chemical Industries Association in 
major hazard topics, and we expect to maintain our 
close contacts with them on aspects of mutual in- 
terest. In particular we have been considering, as 
shown by our comments in Chapter 6, the design of 
control rooms, and have noted that the CIA have 
prepared a code of practice 24 on this topic. It is likely 
that continuing interest in the subject will highlight 
areas for further research. Furthermore we hope to 
continue discussions with the CIA's Chlorine Producers 
Sector Working Party which has world-wide affilia- 
tions and which is an important source of information 
on this substance including details of research that is 
being conducted in various parts of the world. 

205 With regard to information exchange agree- 
ments, the Health and Safety Executive is a party 
to two which are of special interest. The first is 
with the US Coastguards in connection with the 
spillage of cryogenic hazardous materials on to water, 
and is related to the collaborative work mentioned 
above. The second concerns an information exchange 
between the Atomic Energy Authorities of France and 
the United Kingdom. While this agreement is orien- 
tated to the nuclear power industry, it will be concern- 
ed with aspects such as the effects of aircraft crashes, 
of seismic activity, and of external explosions on 
structures, some of which may be of interest with 
respect to our considerations. 

206 Of great value to the committee is the experience 
of members of the Risk Appraisal Group of the 
Health and Safety Executive which meets regularly to 
give advice to local authorities who refer planning ap- 
plications concerning developments at or near plants 
with a high hazard potential. We have asked the Ex- 
ecutive to keep us informed of the nature of problems 
that are encountered to enable us to obtain a view of 
the various types of hazardous plant which are planned 
and to learn of those aspects which require further 
study in order that more reliable information may be 
available for advising the planning authorities of the 
risks involved in particular situations. 
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9 Forward look 



There is inevitably a continuing need for a 
forum in which the problems that arise in the 
major hazard field can be discussed by 
people with the appropriate expertise. This 
chapter identifies areas in which the commit- 
tee sees a need for further work. 

207 At the completion of this second report on our 
deliberations it may perhaps be appropriate to take 
stock of the position we have reached in tackling the 
problems which we face in this field. We see this as 
being of particular interest to the Health and Safety 
Commission in their consideration of the future de- 
velopment of the various advisory committees which 
they have set up. 

208 In the course of this report we have amplified 
the system we proposed in our first report for the 
control of potentially hazardous installations by 
describing how we drew attention to the activities 
which we saw as lying within our terms of reference, 
and how we arrived at the various levels proposed for 
a system of control. We have also dealt with specific 
aspects such as the categories of people and hazard 
areas in relation to risk, the siting and construction of 
buildings on site and limitations of access thereto. We 
do not however see the completion of our second 
report as marking the end of our deliberations and we 
therefore propose to indicate some of the areas in 
which we see a need for further work. 

209 The development of the system of notifications 
and hazard surveys which will be introduced by the 
proposed Hazardous Installations (Notification and 
Survey) Regulations will lead to the building up of a 
comprehensive picture of hazardous activities in this 
country to which we attached particular importance in 
our first report. As that picture becomes clearer and 
we can see how these proposals are developing, we 
shall return to the subject of licensing and consider 
whether there is a need for the introduction of specific 
authorisations for installations falling within certain 
parameters. Indeed, the development and refinement 
of the notification and hazard survey scheme repre- 
sents the foundation on which all our other work can 
be built. 

210 Within that framework we see a number of 
more specific problems still requiring investigation. 
Some have been referred to in the course of this 
report, for example we are still discussing the extent 
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to which pipelines should be brought within the 
notification system; as already mentioned in Chapter 
1 we want to look at particular problems such as dust 
explosions and cataclysmic fires; and there may be 
some benefit in applying the overall approach which 
we have developed to the assessment of hazards in the 
transport of materials even though detailed regula- 
tions are being drawn up elsewhere. 

211 One particularly important area is the develop- 
ment of a siting policy. We referred to this in our first 
report particularly from the point of view of being 
able to offer more specific guidance to planning 
authorities which might perhaps enable them to deal 
with certain categories of planning applications re- 
lating to potentially hazardous activities without 
reference to the Health and Safety Executive. The 
development of a siting policy is of course a complex 
and time consuming task. We understand that some 
preliminary thought is already being given to this 
within the Health and Safety Executive. 

212 There will also be the ongoing need for monitor- 
ing research activities. This will already be apparent 
from Chapter 8. We see our research sub-group as 
constituting a forum both for monitoring current 
research activities within as well as outside the direct 
control of HSE and for discussing future needs in the 
research field. 

213 During the course of our enquiries and discus- 
sions we have noted that in some circumstances the 
various methods and processes that can be employed 
in the course of manufacture or storage of a given 
material differ significantly in their hazard potential. 
For example, the large scale storage of liquefied gases 
under refrigeration appears to be inherently safer than 
storage under pressure, though both methods are cur- 
rently in use in different locations. Similarly we 
understand that the replacement plant at Flixborough 
employs a technology significantly safer than the 
previous one. Nevertheless care is needed to ensure 
that risk is not merely transferred elsewhere. However 
we believe that there may be much greater opportun- 
ity to use alternative processes than may be im- 
mediately obvious and we would strongly urge in- 
dustry consciously to look for them and to develop 
them and we hope the HSE will encourage this kind of 
approach. There is a long history of successful 
substitution of materials in relation to toxic hazards 
exemplified by the use of safe abrasives in place of 
sand-blasting and the use of lead free glazes in the 
pottery industry. 



214 We hope that our proposals for the stricter con- 
trol of hazardous installations will contribute 
significantly to the reduction of hazard potential and 
will encourage industry to consider safety as a reason 
for choosing one path to an end product in preference 
to another even though the latter might appear to be 
initially more attractive. 

215 We can envisage in the future, as a result of our 
proposals, a situation where a company might have to 
justify the use of a particularly hazardous process or 
material in preference to a safer one (see Appendix 1). 
Once the concept becomes widely accepted that 
technical feasibility is not the only criterion which 
must be considered in developing a new process then 
there is reason to hope that more resources will be 
diverted into finding safer processes and materials as 
well as more effective means of manufacture. A deter- 
mined research effort to find safer processes in the 



long term might well have notable side advantages in 
reduced cost as a result of reduced problems of con- 
tainment. 

216 There remains therefore a considerable amount 
of work to be done in the major hazard field. Much 
of it is of a continuing nature and thus leads us to the 
conclusion that there is a case for some kind of per- 
manent forum in which the problems that arise can be 
discussed by people with the appropriate expertise. 
The structure of that forum is not for us to decide. 
We would confine ourselves to pointing out that the 
original concept of a committee of experts who 
brought their individual experience to the deliberations 
of the committee has in our view worked well be- 
cause it has enabled individual members to initiate 
ideas and generate discussion papers with a noticeable 
degree of momentum. We would hope that this 
momentum can be maintained. 
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10 Conclusions and recommendations 



Notification and inventories 

1 We have refined the criteria contained in our first 
report and have drawn up a revised list of substances 
and quantities requiring notification to the Health and 
Safety Executive. This generally confirms our original 
scale of quantities (para 34, 35). 

2 The recommended details to be included in a 
notification are set out in para 40. 

3 If completely separate control is involved, there is 
no strong case for the aggregation of hazardous 
substances in a notification requirement. Similarly, 
undertakings which have under one control a number 
of hazardous substances in quantities below the 
notifiable level, need not be notified (paras 38, 39). 

4 The proposed Hazardous Installations (Noti- 
fication and Survey) Regulations should include a 
'violently toxic substances' category, (para 10) and in- 
stallations containing materials under pressure should 
also be subject to notification (para 18). 

5 Discussion on the specific requirements for the in- 
clusion of pipelines in the proposed notification 
scheme is well advanced (para 15). 

Assessment of hazard 

6 Further investigation should be made into the 
causes, behaviour and consequences of fireballs and 
dust explosions (paras 14, 19). 

7 We believe there is some evidence to support the 
formulation of a scaling law for explosives and it may 
be that with sufficient data such a law could be 
deduced for toxic releases. This seems to be a promis- 
ing field for further theoretical and experimental work 
(para 25). 

8 Data derived from a historical approach provide 
some bases for estimating the levels at which inven- 
tories should become notifiable. Techniques of predic- 
tion also have an indispensable role both in analysing 
the historical record, and in foreseeing situations for 
which historical evidence is lacking or is insufficient 
(para 27). 

Hazard surveys 

9 Persons in control of installations containing 
hazardous substances in quantities which exceed the 
notification inventories by a factor of 10 should be re- 
quired to carry out a hazard survey. 

This criterion should be regarded as an interim 



measure, and the regulations should be prepared in a 
form to facilitate amendment if required. In due 
course it will be appropriate to require hazard surveys 
for notifiable installations other than those which ex- 
ceed the above criterion, but not necessarily for all 
notifiable installations (paras 45,46). 

10 The survey should state the ways in which, under 
fault conditions, the hazardous material might escape 
from containment; the quantity and rate of release, 
the effects, the probability of occurrence, and the 
precautionary measures of prevention. 

The survey should not be a once-for-all operation; 
further surveys should be carried out whenever signifi- 
cant changes invalidate the original survey; the ad- 
ditional survey being completed before the changes are 
made; also in every case at fixed intervals. In some 
cases, a more elaborate assessment may be called for 
by the Health and Safety Executive (paras 48, 50, 51). 

Legal controls 

11 In areas of high risk it is not sufficient for 
employers merely to demonstrate to themselves that 
all is well. They should be required to demonstrate to 
the community that their plants are properly designed, 
well constructed, and safely operated. 

12 The committee has reservations about the effec- 
tiveness of a system of detailed regulations made 
under the 1974 HSW Act, with regard to potentially 
high hazard plants and feel that strongly interven- 
tionist licensing schemes have inbuilt drawbacks. 

The concept of the employer having to demonstrate to 
the enforcing authority the steps taken to ensure the 
safety of the operation would keep responsibility 
within industry (paras 58, 68, 75). 

13 A greater degree of particularization and doc- 
umentation would not depart from the principle of 
'supervised self-regulation' (para 77). 

14 An outline of a possible scheme for licensing 
plant of the highest hazard is at Appendix 1 . 

Planning 

15 The location of a 'hazardous' development 
should always be a planning matter, but the subse- 
quent containment and control of a hazard is more 
appropriately and effectively dealt with under health 
and safety at work legislation (para 82). 

16 Developers of proposed notifiable installations 
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should be required to inform the local planning 
authority that a notification under the (proposed) 
regulations has been sent to the HSE (para 87). 

17 Local planning authorities should impose a stan- 
dard condition, prohibiting without specific consent 
the introduction of notifiable hazards at a later date 
on all planning permissions of an industrial nature 
(para 88). 

The introduction of a notifiable hazard at an existing 
installation, or a change of use, should be capable of 
planning control. An alteration to the definition of 
development in the 1971 Act would appear to be the 
most effective method (para 96). 

18 Amendments to the Use Classes Order and the 
General Development Order would provide a reason- 
able measure of additional control, particularly if the 
notifications regulations come into force. 

The committee recommends that these changes be 
made without prejudice to the proposal to amend Sec- 
tion 22 of the 1971 Act (para 96). 

19 Hazard intensification is more appropriately dealt 
with under health and safety legislation, but the com- 
mittee recommends that the HSE should inform plann- 
ing authorities of any intensification of existing 
hazards notified to them under the proposed regu- 
lations (para 99). 

20 Until greater precision is possible, general advice 
would be beneficial to. planning authorities to ensure 
that incompatible land uses are kept apart (para 102). 

21 The extent of the discretionary powers of the 
Secretary of State for the Environment to make com- 
pensating contributions to local authorities, should be 
reviewed (para 107). 

22 The committee endorses the view of the HSE that 
the existence of intervening development should not 
alter the advice that it gives about the possible effects 
of that activity on proposed developments which may 
appear to be less at risk than the existing ones (para 
108). 

Explosion hazards 

23 The most significant factors affecting the 
magnitude and the nature of vapour cloud explosions 
include: 

the total effective mass of vapour and spray in the 
cloud; the volume, shape, and composition of the 
cloud. 

The magnitude of the overpressure should be taken as 
1 bar and 0.7 bar respectively at the middle and edge 
of the cloud and the duration of the overpressure can 
be taken as 30 ms until more information becomes 
available. The explosive effect in the far field can be 
taken for hydrocarbons as equivalent to 0.3 tonnes of 
TNT for every tonne of flammable material in the 
cloud, (paras 117, 118, 119, 120, 125, 131, 132). 

24 We have not found cause to change our view that 



if 15 tonnes of vapour can be released, an installation 
should be regarded as offering a major explosion 
hazard (para 123). 

Site safety 

25 Site management buildings should be as remote 
as reasonably possible from potential sources of ex- 
plosion or major fire, and be adequately designed. 
Every effort should be made to reduce, or eliminate, 
all but direct operational activities from buildings ad- 
jacent to the hazard. 

If under specified conditions and assumptions, an air- 
borne emission of flammable material exceeding 15 
tonnes may occur, a strong control building will be 
needed and, if reasonably possible, it should be sited 
outside the confines of any likely vapour cloud (paras 
139, 144, 154, 155). 

26 Emergency control must be separately located, 
preferably near to a main entrance to a site, and the 
building must be so constructed as to be capable of 
withstanding any explosion which could occur on the 
site (para 150). 

27 There must be a system to divide the site into 
areas of hazard degree, and criteria should be set for 
the limitation of access to those areas acknowledged 
to be the most dangerous. 

No one should be permanently housed in, or have ac- 
cess to, a designated area unless there are good 
reasons for that person to be there. 

Site office blocks should be located and so designed 
as to not put the occupiers at serious risk (paras 170, 
173, 178, 179, 182). 
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Appendix 1 Model conditions for a 
possible licensing scheme for selected 
high hazard notifiable installations 



The conditions outlined in this appendix have been 
written to give guidance as to the range and the scope 
of the requirements that might be required if a licens- 
ing system of control were adopted for major hazard 
installations with the highest hazard potential. As in- 
dicated in Chapter 3, the committee is not yet in a 
position to say if certain installations should be 
regulated in this way until more information is 
available, particularly from the proposed Hazardous 
Installations (Notification and Survey) Regulations. It 
is, however, clear that there is a gradation of hazard 
with size and complexity of plant, and as this is in- 
creased there should be a greater degree of control 
and surveillance by the organisation in control of such 
activities. Thus this appendix has a wider application 
than the possible requirements for a licensing system 
of control. It is recommended that any organisation 
operating a major hazard plant, particularly one at 
the highest level of hazard potential, should review 
and satisfy itself that it could demonstrate that the re- 
quirements given below are adequately met. 

With regard to a possible licensing system it is 
recognised that a licence is the most stringent form of 
control under the major hazards arrangements and 
would be applied only to those notifiable installations 
which present the greatest hazard potential. The 
licence would be granted to the organisation which 
operates the installation and would be valid only for 
the specified location. 

The approach adopted to licensing would be that fore- 
shadowed by the Robens Committee and embodied in 
the Health and Safety at Work, etc Act 1974, namely 
that safety is the responsibility of the organisation 
which should demonstrate that it is taking appropriate 
measures to ensure effective control of the hazards. 

The licensing procedure might be in two stages. At the 
first stage the organisation would provide the Health 
and Safety Executive with a statement of intent cover- 
ing the nature of the proposed installation, the 
hazards and the features of the design and operation 
intended to control the hazards. At the second stage 
the organisation would provide HSE with design and 
operating information to show how the statement of 
intent is implemented. 

The documentation required might be in two parts 
corresponding to these two stages and consist of: 

Part 1 

(a) The systems documentation. 
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(b) The preliminary design document. 
Part 2 

(a) The background documentation. 

(b) The design document. 

(c) The operating document. 

The systems documentation, which is relevant to the 
licence conditions 1-9, would be concerned with the 
general systems which the organisation has set up to 
ensure safety and could be used in support of more 
than one licence application provided that it is up-to- 
date. 

Details of the preliminary design document are given 
in licence condition 10. 

The purpose of the preliminary design document 
would be to show the general nature of the instal- 
lation and of any associated hazards. The onus would 
be on the organisation to draw attention at this stage 
to any special features which might have an important 
bearing on the granting of a licence. 

The background documentation would be document- 
ation on the implementation of licence conditions 1-9, 
in relation to the particular installation. 

Details of the main design document and the main 
operating document are given in licence condition 10. 

The main design document would be essentially a 
more up-to-date and detailed version of the prelim- 
inary design document, including additional details, 
such as materials of construction for the main plant 
items. 

The main operating document, which incorporates the 
operating manual, would give details of the personnel 
structure for the operation of the installation. 

A licence would be granted for a particular instal- 
lation on a given site. The licence would not itself 
deal with questions of siting, but the issue of a licence 
is an indication that an installation meets certain stan- 
dards and this is relevant to siting considerations. 

The licensee would be required to inform HSE of 
significant changes which are proposed in any of the 
matters within the scope of the licence. 

Conditions for a licence 

The conditions for the issue of a licence are that the 
licensee shall demonstrate to the Health and Safety 
Executive that the design, construction, operation, 
maintenance and modification of his installation are 



or will be to a standard appropriate to the installation 
and in particular that the following features of his 
organisation are to such a standard: 

1 The management system 

2 The safety system 

3 The responsible persons 

4 The arrangements for the identification of hazards 

5 The arrangements for the assessment of hazards 

6 The arrangements for the design and operation of 
pressure systems 

7 The arrangements for the minimisation of 
exposure of personnel 

8 The arrangements for the administration of 
emergencies 

9 The arrangements for reporting of and learning 
from incidents 

10 The design and operating documentation. 

Licence condition 1: the management system 

The organisation should show that it has and supports 
a management system and staff structure which com- 
bine to ensure continuing effective control of the in- 
stallation and its hazards. 

The staff concerned include contractors and con- 
sultants. This aspect is considered further in licence 
condition 3. 

The organisation should show the management struc- 
ture, making clear the distinction between executive 
and advisory functions and should give a brief job 
description for each post. 

The management system should give full support to 
the personnel who are responsible for the design and 
operation of the installation. Important elements in- 
clude a suitable and well understood management 
structure; adequate human resources including 
coverage of absences, vacancies and emergency situ- 
ations; recruitment, training and career planning; and 
effective communications. 

The management system should in particular provide 
satisfactory arrangements in the areas which are the 
subject of licence conditions 2-9. There should be a 
comprehensive, formal and documented set of systems 
and procedures. 

The management should define the objectives of its 
system of documentation in respect of immediate 
communication and of record-keeping and should 
specify the extent of the documentation required and 
the procedures for producing it. 

The management system should provide for thorough 
initial and continuing training of personnel in their 
work generally and in safety in particular. 

Full use should be made of appropriate standards and 
codes of practice. Where there are standards or codes 
which have statutory backing or which are commonly 



recognised within the UK as constituting sound prac- 
tice, these should be applied as a minimum. Where 
there are no approved or accepted standards or codes 
the situation should be covered by the adoption of 
sound practice and the use of in-house codes. 

The management system should include formal pro- 
cedures for the control of modifications made to the 
plant or to the process, whether during design or dur- 
ing operation. 

The management system should require the indepen- 
dent assessment of features which are critical to the 
safe operation of the installation. This independent 
check is essential for inspection of pressure systems 
and for reliability assessment of instrument trip 
systems. The guiding principle is that the feature is 
critical to safe operation of the installation. It is ac- 
ceptable that the check be done by an in-house 
authority provided that this is genuinely independent 
of the interested party. Thus pressure system inspec- 
tion, for example, must be done by an authority in- 
dependent of the operating authority, as described by 
licence condition 6. 

The management system should contain a variety of 
arrangements for the periodic audit both of the con- 
tinuing appropriateness of systems and of the con- 
tinuing effectiveness of their implementation. 

Background 

It is considered that in the case of major hazard in- 
stallations the control of the plant and its hazards re- 
quires a considerable degree of formalisation of com- 
munications through written systems and procedures, 
standards and codes of practice. This is essentially to 
encourage, and where appropriate enforce, collective 
and personal discipline by the use of operating 
methods which have been carefully thought out and 
which contain an appropriate level of checks and 
counterchecks to obviate problems and reduce errors. 

It is recognised that there is always the problem of 
over-administration through paper-work and what at 
times seems like 'going through the motions' without 
apparently contributing anything useful. However, it 
is considered that a careful review of incidents will, 
time and again, illustrate that there was a loss in 
discipline because appropriate procedures either did 
not exist or were not observed. 

There should be an interlocking set of systems and 
procedures to ensure safety through sound engineering 
and management practices. There is no upper limit to 
the number of procedures which can be formalised, 
but there is nothing to be gained by deliberately trying 
to maximise the number. The optimum number is that 
which leaves no obvious gaps but avoids creating con- 
fusion by overlapping. 

Many of the required procedures are implicit in the 
various licence conditions which follow. It is evident 
that key procedures include those for the identi- 
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fication of hazards, the assessment of hazards, the 
control of maintenance through permits-to-work, the 
control of modifications to process or plant, the in- 
spection of equipment, the operation of the process 
(normal and emergency), the control of access, the 
conduct of safety audits, the reporting of incidents. 

Self-auditing features should be built into the manage- 
ment system in the form of formal instructions for 
periodic checks on those parts of the system which 
may become degraded unnoticed. The operation of a 
permit-to-work system, for example, should be sub- 
jected to regular audit by some means such as an in- 
struction, not merely an exhortation, to the plant 
manager to sample a proportion of permits each week. 

Licence condition 2: the safety system 

The organisation should show that within the man- 
agement system there is a safety system which is 
appropriate to the level of hazard inherent in the 
installation. 

The safety system should in particular provide for 
satisfactory arrangements in the areas of the safety 
organisation, safety objectives and assessment, safety 
consultative committees, and safety training. 

The organisation should show that it has people com- 
petent to operate the safety system. 

Background 

Most of the aspects of the safety system mentioned 
are already legal requirements, but it is the object of 
this section to review their adequacy in relation to the 
major hazard installation. 

A distinction can be drawn between the technological 
and human sides of safety. On a major hazard plant 
the technological features are obviously particularly 
important. The responsibility for these aspects rests 
primarily with the qualified technical staff in the 
design and operations areas. There should be no 
neglect, however, of the human side. On the contrary, 
on a major hazard plant it is more important than 
ever to run a 'tight ship 1 as far as safety is concerned. 

The authority of the safety staff should be made 
clear, particularly in relation to the more technical 
aspects of the installation. Attention should be paid to 
the means of ensuring that the safety officers/advisors 
are effective and are seen to be so. 

The safety objectives set for management and the 
assessment of the performance in meeting these objec- 
tives should be indicated. This may not be a simple 
matter of accident statistics. For major hazard in- 
stallations there is an additional problem of avoiding 
rare but catastrophic events. This makes it important 
to monitor both the occurrence of 'near misses' and 
the degree of adherence to procedures and rules. 

The programme of safety training provided for em- 
ployees at all levels should be outlined. 



Attention is also drawn to licence condition 9 which is 
concerned with the system of reporting of and learn- 
ing from incidents. 

Licence condition 3: the responsible persons 

The organisation should nominate responsible persons 

who are in charge of the design and operation of the 

installation. 

The term 'responsible person' has a specific meaning 
in the context and is explained below. 

The organisation should show the management struc- 
ture down to the lowest level of executive technical 
management, making clear the distinction between ex- 
ecutive and advisory functions. There should be a job 
description for each post; the job descriptions for the 
posts held by responsible persons are particularly im- 
portant. 

The level of seniority held by the responsible person 
should normally be either the lowest or second lowest 
level of technical executive management. 

It is envisaged that persons immediately senior to the 
responsible persons will themselves normally have 
been or be qualified to be a responsible person on 
major hazard installations, though not necessarily on 
those processes of which they are now in charge. 

The organisation should show that a person 
nominated as a responsible person is qualified to hold 
the post by reasons of his academic qualifications, 
practical training and recent relevant experience. 

On the operations side this experience should be ex- 
perience in the operation of the actual process or of a 
similar process. Experience limited to design of the 
process or of similar processes and/or to operation of 
dissimilar processes is not acceptable. On the design 
side the experience should be in the design of similar 
processes. 

Where the process incorporates features of consider- 
able technical novelty as a result of which no person 
has first-hand experience of operation of relevant full- 
scale plant even greater regard must be paid to the 
level of competence of the individual and normally ex- 
perience of pilot plant operation would be required. 

Where the installation is to be designed in part or in 
whole by an outside contractor it is the responsibility 
of the organisation which will operate the installation 
to satisfy itself and to demonstrate to HSE that the 
design is to an appropriate standard. The minimum 
requirement is that there be a nominated responsible 
person in the operating company who has the duty of 
liaison with the contractor. Where practical it is also 
desirable to have nominated responsible persons in 
charge of design in the contracting company. 

For convenience reference is made here only to design 
and operation. The organisation should enumerate all 
the project activities such as fabrication, construction, 
inspection, commissioning and satisfy itself and HSE 
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that there are nominated responsible persons respon- 
sible for these activities. 

It is emphasised that the ultimate responsibility for 
the safety of the installation lies with the organisation 
which operates it. 

Background 

The concepts of 'responsible' and 'authorised' persons 
occur in various management systems. Our usage of 
these words is that 'responsible' relates to a job, e.g. 
plant manager, and 'authorised' to a task, e.g. signing 
a permit-to-work. 

We have considered various models for responsible 
persons. These include those in the Mines and Quar- 
ries Act, the Merchant Shipping Act, the Factories 
Act (radio-active substances), the Explosives Act, the 
Medicines Act. 

We have also considered the arrangement whereby the 
Department of the Environment advised by the In- 
stitution of Civil Engineers recommends individuals 
for the design of reservoirs. 

Competence to do a job must depend on the defin- 
ition of the job and its relation to other jobs. We 
began, therefore, with a consideration of manage- 
ment structures and reviewed possible general models 
for a large and a small firm. It became apparent, 
however, that this was not a particularly helpful ap- 
proach and it was not pursued. However, in a con- 
crete situation we do consider the presentation of such 
a management structure and job descriptions desirable. 

With regard to the level of seniority we started with 
the proposition that the responsible person should be 
at the lowest level of the executive technical manage- 
ment. However, this could give rise to problems in 
some areas. For example, it is necessary to train for 
succession and by definition trainees must be at a 
lower level. Such additional lower levels are not nor- 
mal in existing practice, would be wasteful and would 
not offer job satisfaction. We therefore prefer to 
leave a degree of flexibility. But we do attach impor- 
tance to ensuring that the responsibility is real rather 
than nominal and is at the lowest practicable level. 

Thus we envisage that the responsible person on the 
operations side would usually be capable of 'stepping 
down' and carrying out the job at the next level down. 

With regard to selection of responsible persons we 
consider academic qualifications, practical training 
and recent relevant experience are essential. 

We think it is desirable that the person chosen should 
have the sort of broad scientific and technological 
education which a first degree in science or engineer- 
ing usually gives. We consider that such a degree 
should normally be a necessary qualification. Excep- 
tionally, however, people without a degree may be 
considered. We also attach importance to the ability 
of the person to recognise problems outside his sphere 



of competence and to his willingness to seek the ad- 
vice of other experts. 

We consider that although the Flixborough disaster 
has emphasized the importance of the integrity of the 
plant, there may be other major hazards where the in- 
tegrity of the process is of at least equal importance. 
Thus, whilst it is probable that the responsible person 
will normally be an engineer there will be cases where 
he will be a scientist e.g. chemist. 

We attach particular importance to the selection of 
responsible persons on the operations side. 

We lay particular emphasis on recent relevant ex- 
perience. There is obviously room for discussion as to 
the 'relevance' of experience or the 'similarity' of pro- 
cesses. It is up to the organisation to convince HSE on 
these points. 

We stress, however, that we would not want this em- 
phasis on recent relevant experience in any way to in- 
hibit technological innovation or normal career 
development. 

We accept that technological progress requires special- 
isation. The professional institutions already recognise 
this and are considering a register of persons con- 
sidered competent to design and operate major hazard 
installations. We are maintaining contact, although, 
whilst welcoming their interest, we see a number of 
difficulties in this approach. 

The requirement to nominate responsible persons 
should not be seen as detracting in any way from the 
necessity for a team effort by management to achieve 
high standards of safety in plants which have major 
hazards. 

Licence condition 4: the arrangements for the 
identification of hazards 

The organisation should show that is uses appropriate 
methods of hazard identification at all stages of the 
project. 

The terms 'hazard identification' and 'safety audit' 
refer to mainly qualitative techniques which review the 
existence of a hazard. 

The application of the techniques should be matched 
to the stages of the project, starting with coarse scale 
investigations and progressing to fine scale studies to 
discover detailed faults. 

The management system should contain a formal re- 
quirement for the use of such methods, should specify 
the documentation required arising from this use and 
should monitor this use. 

The organisation should show that it has people com- 
petent to implement these methods of hazard identi- 
fication. 

Background 

The first objective of hazard identification is to reveal 



the substances or processes which have a hazard po- 
tential. The second objective is to identify all con- 
ceivable threats to the installation or its processes 
which might lead to loss of containment. 

As technology has progressed identifying hazards has 
become in some ways more difficult. In particular, 
there are many hazards which are not revealed by 
traditional visual inspection. It has become necessary, 
therefore, to develop additional methods of hazard 
identification. 

An illustrative list of methods is given in Table 1. 

Since every human enterprise involves the possibility 
of error it follows that the soundness of the manage- 
ment of the potentially hazardous installation is the 
predominating factor and that the first essential in all 
cases is an audit of the management system as a whole. 

It is recognised that there is a wide variety of methods 
of hazard identification in use in industry and that 
different techniques are applicable to different situ- 
ations. There is no intention of imposing any par- 
ticular method. 

It is necessary that the use of these methods be a re- 
quirement of the management system, which also 
should specify the degree of recording and documen- 
tation required and should contain a mechanism for 
auditing the application of the techniques to ensure 
that they are used. 

The people who have to implement these techniques 
must be competent to do so. HSE should be able to 
advise on opportunities for training in this area. 

Hazard identification covers much the same ground as 
safety audits in the broadest sense. The Chemical In- 
dustries Association has published two guides entitled 
"Safety Audits: A Guide for the Chemical Industry" 
(1973) and "A Guide to Hazard and Operability 
Studies" (1977). 

Licence condition 5: the arrangements for the assess- 
ment of hazards 

The organisation should show that the hazards iden- 
tified by the means described in the preceding section 
have been removed or that the associated risks have 
been reduced to a minimal level. 

In this context 'minimal' means that the probability 
that an employee or member of the public will be kill- 
ed or injured or that property will be damaged is at 
least as low as in good modern industrial practice. 

The method of demonstrating that the risks are at a 
minimal level should be comprehensive and logical. 

The method may consist of: 

(a) the use of codes of practice generally recognised in 
the industry 

(b) the use of special testing 

(c) the use of calculations based on appropriate data. 



In many cases it will be sufficient to show for all or at 
least some aspects of the hazard that a generally 
recognised and accepted code of practice is applicable 
and has been followed. 

Where there is any aspect of the hazard, the risk of 
which cannot be reduced to a minimal level by follow- 
ing a recognised code of practice or by special testing, 
then, whenever meaningful, quantitative methods 
should be used to demonstrate that the risk has been 
reduced to a minimal level. These quantitative 
methods will normally consist of three steps: 

(a) An estimate of the consequences to employees and 
the public 

(b) An estimate of the frequencies with which hazard- 
ous situations will occur 

(c) Comparison of (a) and (b) with the other risks to 
which people are normally exposed in order to 
show that the risk under consideration is relatively 
small 

The management system should contain a formal re- 
quirement that such methods of hazard assessment 
shall be applied. 

The organisation should show that it has access to 
people competent to implement these methods. 

Background 

Having identified hazards, as described in the pre- 
vious sections, it is necessary to know that the 
associated risks have been reduced to a minimal level. 

It is envisaged that the method of demonstrating the 
risks are at a minimal level will normally be based on 
a fault tree approach, but that a detailed development 
of all parts of the tree will not generally be required. 

Sometimes it is possible to remove a hazard complete- 
ly, for example, by replacing a flammable or toxic 
raw material by a non-flammable or non-toxic one. 

More often, the hazard cannot be eliminated com- 
pletely, though the risk can be reduced to any desired 
level by use of protective equipment. For example, the 
risk that a particular vessel will burst because of over- 
pressure can be reduced by fitting a relief valve 
suitable for the duty, adequately sized and properly 
maintained. This does not eliminate the hazard com- 
pletely as there is a small probability that the relief 
valve will fail to lift when required. Even if two relief 
valves are fitted, there is still a very small probability 
of coincident failure. 

In many cases codes of practice provide generally 
recognised and accepted methods of reducing a hazard 
to a minimal level. For example, in the case just con- 
sidered, it would normally be sufficient to show that 
the vessel is fitted with a relief valve, adequately sized 
and properly maintained, as relief valves have been 
generally recognised for many years as an accepted 
way of reducing to a minimal level the probability 
that a vessel will burst. 



Similarly; if fracture of pipework has been identified 
as a hazard, it would be sufficient to show that the 
pipework has been designed and constructed and will 
be operated and maintained in accordance with a 
recognised and relevant code of practice. 

Codes of practice should not be used outside their 
area of applicability. Codes of practice for pipework, 
for example, do not cover fracture by projectiles and 
if it is necessary to take the latter into account, a 
separate study is necessary. 

Moreover, codes of practice imply acceptance of some 
level of probability of the hazard materialising. This 
level will be unacceptably high in relation to some 
major hazards. 

In some cases it may be necessary to carry out special 
tests to quantify aspects of particular hazards. 

Where there is no generally accepted code of practice 
and where the problem cannot be resolved by testing, 
but where it is reasonably practicable to show quantit- 
atively that the risk has been reduced to a minimal 
level, this should be done. In some cases this cannot 
be done because of the lack of data or of a suitable 
model to describe the system. In these cases judge- 
ment will have to be used. 

Examples of hazards which may not be covered by 
recognised codes of practice and which, if they pro- 
duce major effects, would have to be individually 
assessed, are: 

(a) Runaway reactions (e.g. decomposition and 
polymerisation reactions) 

(b) Impact of moving objects (e.g. cranes, vehicles, 
missiles from explosions) 

(c) Failure of instrumented protective systems 

(d) Failure of services (e.g. electricity, water, com- 
presed air) 

These can be described as events leading to possible 
loss of containment. 

The hazard quantification will normally consist of 
three stages in which probability and consequence 
must both be considered; sometimes it will be necess- 
ary to consider a number of possible outcomes differ- 
ing in probability and consequence. An event which 
has the potential to kill many people may not cause 
great concern if the probability of it occurring is suf- 
ficiently small. We do not prohibit football matches 
because there is a small chance that an aeroplane may 
crash on the crowd. On the other hand we would not 
build a new football ground at the end of a busy run- 
way. 

(a) The first stage is the estimation of the probable 
consequences of the hazard. This may be based on 
past experience or it may be estimated from a 
theoretical study of the problem. The conse- 
quences may be expressed as the probability that 
an employee or a member of the public will be 
killed or injured or as the probability that exten- 



sive damage will be caused to the property of 
others, or both. 

(b) The second stage is the estimation of the 
probability that the hazard will occur. Again this 
estimate may be based on past experience, or it 
may be synthesised from data on the failure rates 
of individual components or pieces of equipment. 

In estimating the probability that the hazard will oc- 
cur it is necessary to assume that certain standards are 
followed in the operation of the equipment, for exam- 
ple, that relief valves are tested regularly. If these 
standards are not followed the conclusions of the 
hazard quantification are no longer valid. 

(c) The third stage is comparison of (a) and (b) with 
the other hazards to which people are exposed in 
order to ensure that the risk under consideration is 
minimal. 

This implies the use of a criterion against which risks 
can be judged. It is not intended that any single 
criterion should cover all cases. 

If it is not possible to carry out a complete study as 
indicated (i.e. stages (a), (b) and (c)), it may be pos- 
sible to carry out a partial study and, if so, this should 
be done, as it helps to identify those aspects of the 
problem which have most effect on the probability 
and consequences. 

Where a new feature is used in place of one of proven 
reliability then it should be shown that the new 
feature is at least as safe as, and preferably safer 
than, the original. For example, if an instrumented 
protective system is used in place of a relief valve it 
should be shown to fail no more often, and preferably 
less often, than a relief valve. 

In other cases it may be appropriate to show that the 
risk to an employee is no greater than that for 
employees in the industry as a whole or to show that 
the risk to a member of the public is comparable with 
the other risks to which the public are exposed 
without their consent. 

It may be noted that it is difficult to find examples of 
instances in which members of the public have been 
killed as a result of accidents on major hazard in- 
stallations. In most cases, if the risk to employees is 
minimal, the risk to the public will also be minimal; 
although a lower level of risk is required, the public 
are usually further away. 

It is necessary that the use of quantitative methods, 
whenever meaningful, should be a requirement of the 
management system. This should specify the recording 
and documentation required. 

In some cases a detailed study may be required taking 
many days or even weeks, but in other cases relatively 
simple calculations may be sufficient. 

The organisation should show that it has access to, 
and uses as necessary, people competent to assess 
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hazards, but these people need not be in its full-time 
employment; they may be consultants. 

Quantitative methods provide a means to assist 
management to choose those measures which are 
'reasonably practicable' for providing a safe plant and 
system of work. 

Licence condition 6: the arrangements for the design 
and operation of pressure systems 

The organisation should show that it has a formal and 
well-understood management system for controlling 
and monitoring the design, fabrication, commission- 
ing, operation, inspection and testing of pipework, 
vessels and other equipment together forming the con- 
stituents of a pressure system which may give rise to a 
serious hazard. 

The term 'pressure system' refers to a linked series of 
equipment items operating at a pressure either above 
atmospheric or under vacuum, together with all the 
inter-connecting pipework. Such systems commonly 
form processing units, but the definition includes also 
storage and handling installations. 

The management system of control should be in two 
parts, and should be effected through two recognised 
channels of authorisation, related to design and to 
operation. 

The management design authority should identify and 
state the design parameters within which the pressure 
system is to operate and the conditions for which each 
component part of the pressure system shall be 
designed. It should also define the code under which 
the individual components shall be designed, or where 
no design code exists should cause sufficient work to 
be undertaken to satisfy themselves, either by experi- 
ment or by the use of specialist advisers, that the 
design is at least as safe under all foreseeable cir- 
cumstances as the standard demanded by recognised 
codes. 

The design authority should also define the standards 
to be used for the pressure system during the fabrica- 
tion and construction stages. Whenever possible the 
standards specified should be those quoted in recog- 
nised codes applicable to the particular pressure system. 

Management should ensure that an appropriate in- 
spection system is operated during fabrication and 
construction work to check that the standards set by 
the management design authority are being met. This 
inspection system may be in the same management 
organisation as the design authority, or it may be ap- 
propriate to use one of the engineering insurance 
companies or other approved inspection agency. The 
inspection system should not be part of the operating 
authority. The design authority should also specify the 
written evidence required to demonstrate that the 
plant has been fabricated, constructed and proof- 
tested, in accordance with the design requirements. 
Copies of documentation forming this written 



evidence should be verified, preferably by the inspec- 
tion agency before the pressure system enters service. 
Copies of all documentation relating to the design 
parameters and to the verification by the inspection 
system, should be retained by the design authority and 
should also be available on the works on which the 
pressure system is operated. 

The operating authority should prepare a comprehen- 
sive set of instructions based on information issued by 
the design authority and upon an analysis of hazards 
involved. These instructions should set out clearly the 
way in which the pressure system shall be operated in 
both normal and abnormal circumstances, and the 
way in which the pressure system is to be protected 
from the effect of conditions more extreme than those 
permitted by the design authority. These instructions, 
which should be readily available to all those respon- 
sible for operation, inspection and repair of the 
pressure system, should set the limits within which the 
system is to be operated. Any variation in these limits 
outwith the parameters set by the design authority 
should be referred to the design authority or other in- 
dependent qualified body for approval before fresh 
instructions are issued. Such submission and approval 
should be made in writing and copies retained in the 
works for future reference. 

The operating authority is responsible for ensuring 
that any repairs and modifications are designed, 
fabricated and tested to a standard not less than that 
used by the design authority for the original system. 
The operating authority should have a system of 
documentation which controls the repair and modific- 
ation procedures, so that modification to the pressure 
system cannot be made without written authority 
from an authorised person. 

Thus instructions prepared by the operating authority 
should include formal procedures for identifying and 
making process modifications, for identifying and 
making plant modifications and for restarting the 
plant after discovery of a serious defect. 

The operating authority should also provide and en- 
force the use of a code which ensures the continuing 
safety of the pressure system by a regular inspection 
of the equipment and the safety devices which are 
provided to protect that equipment. Such an inspec- 
tion code should meet the following criteria. Firstly, 
that a register is held on each works in which each 
item of equipment is given a unique designation and 
an engineering description which adequately describes 
the design and fabrication details and also details of 
operating conditions, both normal and maximum. 
Secondly, that the code should specify the frequency 
of inspection for the various classes of equipment and 
should also specify rules concerning the selection and 
training of inspectors. There should also be rules by 
which inspection frequencies may be increased or 
reduced, decisions being based upon the result of in- 
spection records which should be held in the register. 
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The code should specify rules which guarantee the in- 
dependence of the inspecting system from the 
operating authority, either by appointing external 
inspection authorities, or by making satisfactory 
arrangements for the in-house inspection authority to 
be responsible to a senior member of the organisation 
who has the design authority within his charge. 

The organisation should show that it has people com- 
petent to execute the control and monitoring functions 
described above in both the design authority and 
operating authority areas. It should also show that the 
inspection service is truly independent of the operating 
authority. 

Background 

The control of design and operation of pressure 
systems is a cardinal feature for ensuring safe opera- 
tion of major hazard plants. 

The separation of management control into the areas 
of a design authority and an operating authority has 
been made in order to bring out clearly the separate 
responsibilities of these two parts of the total 
organisation which designs, builds and operates a 
major hazard plant. The areas of authority interlock, 
and in small organisations there may be sharing of 
some specialist personnel. It is important, however, 
that the design concept and subsequent modifications 
to that concept should be controlled by an authority 
separate from the operating authority. In cases of 
contractor design the organisation will have to show 
that the contractor can carry out the duties of a 
design authority, particularly in the matter of 
documentation concerning the design parameters for 
the pressure system and the fabrication details, and in 
the provision of competent people for authorisation. 

The use of a regular inspection is an essential feature 
of the safe continued operation of a pressure system. 
The register of equipment and inspection reports is 
the linchpin around which this inspection system is 
built. Decisions on the frequency of inspection and 
the nature of satisfactory inspection procedures 
should be taken by the inspecting authority with ad- 
vice from the design authority. An essential feature of 
the integrity of the system is that the inspectors and 
their management are not under the technical control 
of the operating authority. In small organisations con- 
siderable use can be made of external inspection agen- 
cies and other specialist help. In large organisations 
such facilities are likely to be provided in-house. In 
those cases the organisaton should take particular care 
to show the independence of the inspection agency. 

It is important that safety devices such as relief 
valves, non-return valves and vents are included in the 
register of pressure systems and are subject to the 
same type of inspection and testing arrangements as 
are specified for the pressure equipment. Details of 
testing and frequency of examination may well be dif- 
ferent from arrangements made for pressure equip- 



ment, but the principle of inclusion in a register, 
together with test and inspection notes, is essential. 

A system for registering and inspecting pressure 
vessels and other equipment and for the keeping of 
verification documentation which satisfies many of 
these criteria is described in BS 5500: (1976) Unfired 
fusion welded pressure vessels, in the Pressure Vessel 
Inspection Code and in the draft Piping Systems In- 
spection Code of the Institute of Petroleum. 

Licence condition 7: the arrangements for 
minimisation of exposure of personnel 

The organisation should show that it has assessed the 
hazards to personnel involved in the installation and 
that where necessary it has taken steps to reduce these 
hazards to a minimal level. In particular, measures 
should be taken to limit the number of people at any 
one time in areas of high hazard to a minimum con- 
sistent with safe and efficient operation and to afford 
protection to exposed personnel, who may include 
operating personnel, maintenance personnel, invest- 
igation teams, construction workers and visitors. 

Background 

This matter is fully dealt with in Chapter 7. 

Licence condition 8: the arrangements for the 
administration of emergencies 

The organisation should show that it has assessed the 
hazards involved in the installation in relation to 
major emergencies and has maintained emergency plans. 

Emergency planning should include identification and 
assessment of possible major emergencies; nomination 
of persons responsible for administering an emerg- 
ency; development of procedures for declaring, com- 
municating and controlling the emergency and for 
evacuation; provision of buildings such as a control 
centre or refuge rooms and of equipment such as an 
alarm system; designation of works emergency teams 
and definition of duties of other workers; liaison with 
external services including police, fire and medical ser- 
vices; training and exercises for emergencies. 

Background 

A guide Recommended Procedures for handling 
Major Emergencies is published by the Chemical 
Industries Association (second edition, 1976), This 
covers primarily the administration of emergencies 
within the works. 

The guide also deals briefly with the planning of ac- 
tion, such as evacuation, which may be required out- 
side the works. This is particularly important for cer- 
tain major hazards. It should be emphasized in this 
connecton that for toxic gas hazards the value of the 
time bought by any distance separating the factory 
and the public may be wasted if there is no evacuation 
plan. 
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Licence condition 9: the arrangements for reporting of 
and learning from incidents 

The organisation should show that it has prepared a 
schedule of signals to be recorded and that the rele- 
vant instilments are housed in such a way that an 
accident on the plant is unlikely to prevent recovery 
of the records. 

The organisation should show that it has a system for 
the reporting of incidents which might endanger the 
installation or lead to loss of containment and that it 
uses the information obtained from this reporting 
system to learn how to reduce these hazards. 

These requirements for the reporting of hazardous in- 
cidents are additional to the existing statutory re- 
quirements. They have two main objectives. One is to 
ensure the reporting within the company of the 'near- 
miss' type of incidents which often precede an acci- 
dent. The other is to obtain data at national level on 
incidents related to serious hazards. HSE may request 
that certain types of incident be included. 

Background 

There already exist certain statutory requirements for 
the reporting of incidents. These include 

The Petroleum (Consolidation) Act 1928 

The Factories Act 1961 

The Dangerous Occurrences (Notification) 

Regulations 1947 
as well as those specific to explosives factories, mines 
and quarries, and nuclear installations. 

These requirements are mainly concerned with ac- 
cidents causing plant downtime, lost-time accidents 
and fatalities. 

It is well known, however, that for every serious acci- 
dent there are numerous incidents, including 'near- 
misses'. Since they are more numerous, these incidents 
offer greater scope for learning and improvement. 

It is therefore proposed that the organisation should 
have its own reporting system covering the type of in- 
cident significant in relation to its particular hazards. 

We have deliberately not specified the incidents which 
should be reported but we have in mind incidents 
relating to such matters as 

Incidents involving serious operator error 
Incidents involving trip system malfunction or 
disarming 

Malfunctions of valves e.g. pressure relief, non- 
return 

Leaks of flammable materials 
Leaks of toxic materials 
Leaks and fires at pumps 
Fires and explosions in furnaces 
Storage tank collapse 

The important point is that the reporting system 
should be tailored to the needs of the organisation. 
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There may also be certain types of incident on which 
HSE wish to collect information nationally. In this 
case it may request their inclusion in the reporting 
scheme. Again we have not specified these incidents 
but an obvious one is the unconfined vapour cloud 
explosion. 

These reporting requirements should be seen in rela- 
tion to the fact that we have not recommended that 
all major hazard installations have a 'black box' 
recording instrument system. We consider that the 
arrangements proposed here are a more efficient way 
of learning both at company and national level. 

The reporting system is intended primarily to assist 
the organisation to learn from incidents and it should 
show that is has formal arrangements to do this. 

Licence condition 10: the design and operating 
documentation 

The organisation should provide full documentation 
on the design and operation of the installation. The 
documentation required is as follows: 

Part I Documentation 

(For Part 1 (a) The systems documentation see 
introductory section of this Appendix) 

Part 1(b) Preliminary design document 

This should contain: 

(1) A brief description of the process and should 
include the nature of any chemical reaction 
involved and the various operations to which the 
material in process is subjected. In addition, any 
other exothermic reactions which may arise if 
operating conditions fall outside the design 
values, should be specified. 

(2) A comprehensive description of the nature of the 
hazards in the materials handled (toxic, 
flammable, explosive materials), of the objectives 
to be achieved in order to limit these hazards and 
of the methods in plant design and operation 
necessary to achieve these objectives. 

(3) A statement of any less hazardous process which 
could have been used and the reasons for 
selecting the particular process in question. This 
might include outstanding economic advantages, 
factors relating to the availability of raw 
materials, the avoidance of particularly difficult 
engineering operations or the necessity of making 
a product of a particular purity. 

(4) A process flow sheet, indicating quantities, the 
temperatures and pressures of materials at each 
stage and the vessel inventories, and the flow- 
rates in each of the principal flowlines. The 
reasons why such pressures and temperatures 
must be used should be given. Mass and heat 
balance diagrams should be given where 
appropriate. 

(5) A list of the main plant items, specifying the 
capacity, design pressure, temperature limits for 



safe operation (upper and lower), and any special 
features of construction, together with the actual 
operating conditions. Details of services should 
be given. 

(6) Details of the principal standards and codes to 
be used in the design. 

(7) A statement of the inventory of all hazardous 
materials in process and of the steps taken to 
keep this at the lowest level consistent with safe 
and efficient operation. 

(8) A statement of the method whereby the process 
will be controlled. Abnormal features, with 
particular reference to hazards, should be 
highlighted and references made to any special 
features, including trip systems. 

(9) A list of all hazardous materials in bulk storage 
which may be endangered by a process incident 
and the steps to be taken to minimise the risk of 
their involvement. 

(10) A statement of all materials and services needed 
to maintain safe operation of the plant and of 
the steps taken to ensure their continuous 
availability. 

(11) A statement of any noxious effluents and their 
methods of treatment. 

(12) A site layout showing the proposed plant and 
control room, and their position relative to other 
installations and buildings in the works, to 
loading bays at tanker terminals, to plants in 
neighbouring works and to the public area. 

(13) A statement of the location and construction of 
the control room. 

(14) The routeing for all vehicles needing access to 
the plant, whether for the supply of materials 
and removal of products, or for maintenance or 
emergency purposes. 

(15) An account of the procedures for maintaining 
effective liaison between the company and any 
outside organisations involved in the design or 
construction of the plant. 

(16) Details of actual experience of the company, or 
of availability of experience from external 
sources, in operation of pilot and production 
scale plants, for the same or a similar process. 

(17) Manning levels on the plant. 

(18) Proposals for dealing with emergency situations. 

Part 2 Documentation 

(For Part 2(a) The background documentation, see 

introductory section of this Appendix) 

Part 2(b) The design document 

This should contain: 

(1) An updated and detailed statement of all 

materials submitted in the preliminary design 
document, including the process flowsheet, 
quantities and flowrates of all materials in 



(2) 



(3) 

(4) 



process and storage areas, heat and material 
balances, instrument diagrams and plant layout 
diagrams. 

Details of all principal plant items, as in item 5 
of Part 1(b), giving codes uses, materials of 
construction and any special features. 

Installation drawings and pipe layouts. 

Documentation on hazard assessments and 
reliability studies. 



Part 2(c) The operating document 

This should contain: 

(1) A statement of the technical staff structure, 
including names of the responsible persons, 
together wth details of standby arrangements for 
absence such as sickness or holidays, and of call- 
in arrangements. 

(2) A statement of the numbers of operating 
personnel and of their training with particular 
reference to emergency procedures. 

(3) The operating manual 

This should include details of the start-up, normal 
shutdown and emergency shutdown procedures. 



Table 1 Some methods 


of hazard identification 


Project stage 


Hazard identification method 


— 


Management and safety system 
audits 


All stages 


Checklists 

Feedback from workforce 



Research and development 



Screening and testing for 
Chemicals (toxicity, instability 
explosibility) 
Reactions (explosibility) 
Impurities 

Pilot plant 



Pre-design 



Hazard indices 
Insurance assessments 
Hazard studies (coarse scale) 



Design 



Process design checks 

Unit processes 

Unit operations 

Plant equipment 
Hazard and operability studies 
(fine scale) 

Failure modes and effects analysis 
Fault trees and event trees 
Hazard analysis 
Reliability assessments 
Operator task analysis and 
operating instructions 



Commissioning 



Checks against design, inspection, 

examination, testing 

Non-destructive testing, condition 

monitoring 

Plant safety audits 

Emergency planning 



Operation 



Inspection, testing 

Non-destructive testing, condition 

monitoring 

Plant safety audits 
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Appendix 2 Glossary 



This glossary does not aim to be a dictionary 
of technical terms. Firstly, the terms are 
restricted in number and secondly, it is not 
intended to define these for general use. We 
acknowledge that other meanings may be 
given to the terms in every-day speech, in 
other technical contexts or in industry. The 
purpose of the glossary is to give the mean- 
ings of certain terms as they are used in this 
report. It is in three sections: general; terms 
used in the chemical and process industries; 
and terms relating to explosions. 

General 

Hazard A physical situation with a potential for harm 
to life or limb. 

Risk The probability that a hazard may be realised at 
any specified level in a given span of time; or 
the probability that an individual may suffer a 
specified level of injury as the result of the realisation 
of a hazard in a given span of time. 

At risk A significant probability of harm if a hazard 
be realised. 



Term 



Definition 



Examples 



Storage unit 



Process unit 



Complex 



A unit for storing 
particulate solids, 
liquids or gases or 
containers for such 
storage. 



Silo. Compound for 
storing drums or 
bottled gas. Storage 
tank or storage 
sphere with associated 
facilities for charging 
and discharging. 



An assembly of 
equipment which 
performs a definable 
function in a process. 
Corresponds often 
with the concept of a 
'unit operation'. 



Distillation column 
with reboiler, 
condensers and 
instruments. Steam 
boiler with feed 
pumps, valves and 
instruments. Furnace. 



Plant An assembly of Contact sulphuric 

process units which acid plant. Ammonia 

produces a definable synthesis plant Crude 

product or products, oil distillation plant. 



A group of 
neighbouring plants 
on the same site. 



Site (or factory or 
works) 



Industrial complex 



An area of land with 
a plant or plants with 
their associated 
buildings built on it 
and enclosed by a 
common security 
fence. 

A group of 
neighbouring sites. 



Terms used in the chemical and process industries 

There are a number of related terms in use in the 
chemical petroleum and process industries which, in 
isolation, are-difficult to define. This is because of the 
problems of delimiting the boundaries between some 
of them. 

They may, however, be defined in relation to each 
other and here they are set out in a hierarchy of in- 
creasing size and complexity. 

The committee recognises that their definitions may 
differ in their meaning from those used by a number 
of enterprises in the chemical and process industries. 
It does, however, believe that it is necessary for the 
committee to have an agreed terminology for use in 
its own publications and recommends that the Health 
and Safety Executive should adopt this in any regu- 
lations issued in connection with major hazards. 

Inventory The quantity of a specified material or 
materials which an installation contains when all equip- 
ment is filled to its designed capacity. 



Term 



Definition 



Examples 



Equipment (or The basic items from Pumps, valves, 

equipment item) which process units vessels, pipework, 

are assembled. instruments. 



Terms relating to explosions 

Blast wave When an explosion occurs, the gases 
formed as the result of the reaction (whether from 
gaseous or non-gaseous reactants) are suddenly at 
high temperature and high pressure relative to the sur- 
rounding atmosphere. They therefore expand rapidly, 
driving before them the air they displace, and in- 
itiating a pressure pulse which travels outwards, at 
first with a velocity comparable with that of the ex- 
panding gases and afterwards more slowly, eventually 
degenerating into a sound wave. This pressure pulse is 
commonly described as a blast wave or shock wave. 
As it travels outwards its shape (i.e. the pressure/time 
relationship as it passes a particular point in space) 
changes. For the cases with which we are concerned in 
this report, however, it may be assumed that this 
pressure/time relationship is of the form shown in the 
figure overleaf a very sudden rise ('over 1 atmospheric 
pressure) to some value p, the peak positive over- 
pressure, normally for brevity referred to simply as 
the overpressure, followed by a fairly steady decline 
to zero in time t , called the duration, and thereafter 
to a smaller negative value of longer duration. The 
area J pdt in the interval t under this curve is called 
the positive impulse, or simply, for brevity, the im- 
pulse; the algebraic sum of the positive and negative 
impulses is usually very small, approximating to zero. 
Again for the cases with which we are concerned 



66 



(though not for all) it may be assumed that the cause 
of damage is the positive over pressure phase. 




Typical blast wave 

If a pressure-sensitive device which offered no 
obstruction to the passage of the blast wave (or, 
roughly, one which was facing sideways in relation to 
its advance) were placed in its path, the device would 
record the changes described above. These over- 
pressures are therefore variously described in the 
literature by the adjectives 'sideways-on', 'side-on', 
'lateral', or (misleadingly, but presumably by analogy 
with the pressure base measured by the 'static' limb of 
a pitot tube) 'static'. In this report 'side-on' has been 
chosen as the most descriptive and least objectionable. 
If however a solid object of considerable size is expos- 
ed to the blast wave the effect on each face of the 
object will depend, inter alia, very much on its orient- 
ation. For instance, an isolated wall facing the wave 
will reflect and diffract it, and in so doing will ex- 
perience a total thrust quite different from that which 
would be calculated by simply applying the pressure p 
to its frontal surface. In particular, a 'rigid' wall of a 
building facing the shock wave will experience due to 
the reflection an effective overpressure, usually called 
the reflected overpressure of between two and (for 
shocks of extremely high intensity) eight times the 
side-on overpressure; for the magnitudes with which 
we are chiefly concerned the factor may be estimated 
at two and a half. 

Deflagration The chemical reaction of a material in 
which the reaction front advances into the unreacted 
material at less than sonic velocity. 

Detonation The extremely rapid chemical reaction of 
a material in which the reaction front advances into 
the reacted material at greater than sonic velocity. The 
resultant blast wave is initially characterised by a very 
high peak pressure acting over a very short time. 
However, as the wave travels outwards from the 
source the pressure decays and the time constant in- 
creases, so that after travelling some distance the blast 
wave has characteristics and produces effects similar 
to those from a deflagration. 

Duration See 'Blast wave' 

Epicentre Originally used to denote the point on the 
earth's surface directly over the point of origin of an 
earthquake. The term has now come to mean also the 



inferred centre of an unconfined vapour cloud explo- 
sion (q.v.). 

Explosion A rapid release of energy which causes a 
pressure discontinuity or shock wave, which then 
moves away from the source at a rate determined 
partly by the pressure differential and partly by the 
properties of the medium through which the shock 
wave is propagated. This pressure discontinuity and 
the subsequent shock wave are termed the blast wave. 

A blast wave can be formed by a detonation or by a 
rapid deflagration, or merely by the sudden failure of 
a piece of equipment containing a potential energy 
source which is released at a high rate. 

Thus an explosion and its associated blast wave can 
be produced by the detonation of TNT, or the rapid 
burning (deflagration) of a vapour cloud, or the 
disastrous failure of a pressure vessel containing a 
large volume of high pressure gas. 

Fireball Is the phenomenon which may occur as the 
result of the deflagration (q.v.) of a vapour cloud 
which does not result in a blast wave. 

The burning cloud may lift off the ground and form a 
mushroom cloud. Combustion rates are extremely 
high and may exceed 1 tonne per second. 

Impulse See 'Blast wave' 

Overpressure See 'Blast wave' 

Scaled distance Is the quantity (Z) in Hopkinson's 
Scaling Law. 

For any given explosive 



where R = Distance from centre of explosive source. 
E = Energy of explosive 



Z = 



R 



tf"M 



Where M=Mass of explosive. 

Overpressure is function of Z for a given explosive. 

(see Fig 5) 

Stoichiometric mixture One in which the reactants are 
present in correct theoretical proportions for complete 
chemical reaction. In the case of a cloud of hydrocar- 
bon mixed with air a stoichiometric mixture would 
contain just sufficient oxygen to burn the carbon in 
the compound to carbon dioxide and the hydrogen in 
the compound to water. 

TNT equivalent A convenient way of expressing the 
size of a vapour cloud explosion by calculating the 
amount of TNT which when detonated at a particular 
point would cause damage equivalent to that caused 
by the exploding vapour cloud. The equivalence has 



67 



meaning only at a considerable distance as, for prac- 
tical purposes, the vapour cloud, like tnt, can then 
be considered as a point source and the nature of the 
shock wave is comparable. 

Unconfined vapour cloud explosion An explosion 
which results from the ignition, in the open air, of a 



cloud made up of a mixture of a flammable vapour or 
gas with air. 

Vapour Is,a gas which can be liquefied by the. ap- 
plication of pressure alone without reduction in 

temperature. 
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A catalogue of HSE publications 
is available on sale from 
government bookshops. Indexed 
by subject headings, the catalogue 
is an invaluable source of 
reference for anyone who needs 
access to advice and information 
on the requirements of the 
1974 Health and Safety at Work 
Act and related legislation and 
publications issued prior to 
the formation of the Health and 
Safety Executive. 
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